How to write a workplace violence prevention program for retail

Last updated 2026-07-09

Why does retail need its own workplace violence prevention program?

Retail is more dangerous than most industries for violence, and the numbers back that up. The Bureau of Labor Statistics reported 20,050 cases of nonfatal workplace violence injuries requiring days away from work in trade, transportation, and utilities combined in 2022, a sector where retail makes up the bulk of hours worked ^[1]. Convenience stores, gas stations, and late-night grocery locations have sat near the top of industry risk lists for decades. Cash on hand, late hours, solo shifts, open public access. Those four things stack into a hazard profile most offices never see.

OSHA has no retail violence standard written into the Code of Federal Regulations the way it has a bloodborne pathogen standard (29 CFR 1910.1030) or a hazard communication standard (29 CFR 1910.1200) ^[2]. What it has instead is the General Duty Clause, Section 5(a)(1) of the OSH Act of 1970, which says an employer must furnish a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm" ^[3]. OSHA has cited retailers under this clause for weak violence prevention. If OSHA can show the hazard is recognized (your own incident logs, industry data, or prior complaints all count) and a feasible control existed, you are exposed.

California went further. Cal/OSHA's Workplace Violence Prevention in General Industry regulation (California Code of Regulations Title 8, Section 3342) took effect July 1, 2024 and applies to nearly all California employers, retail included ^[4]. If you operate in California, that standard is your floor now, not the General Duty Clause. Several other state-plan states are watching California closely.

The real reason to write this program is simpler than regulatory exposure, though. Robberies, shoplifter confrontations, domestic violence that follows an employee to work, and customer rage incidents are all predictable in retail. Predictable hazards have controls. Controls cut injuries, and injuries cost real money in workers' comp, turnover, and lost time. The program is the thing that makes the controls happen every shift, more than the day the owner cares about them.

What are the six required elements of a retail violence prevention program?

OSHA's guidance document, "Guidelines for Workplace Violence Prevention Programs for Late-Night Retail Establishments," lays out six program elements ^[5]. California's Title 8 Section 3342 uses nearly the same structure. Whether you write under the General Duty Clause or a state standard, these six are the skeleton of any program that holds up.

1. Management commitment and employee involvement. The program has to be signed by someone with authority, and employees need a real way to report hazards and join reviews. A document signed by an owner or GM, with a named coordinator responsible for the program, handles the first part. A standing process for employees to flag concerns without fear of retaliation handles the second.

2. Worksite hazard analysis. This is a written assessment of where, when, and how violence could happen at your specific location. It is not a generic checklist off the internet. You walk the store, read your incident logs, talk to employees, and write down what you find.

3. Hazard prevention and control. Based on what the analysis turned up, you put controls in place. They follow the standard hierarchy: engineering controls first (locked cash drawers, security cameras, panic buttons), then administrative controls (staffing policies, cash-handling procedures), then personal protective equipment if it applies.

4. Safety and health training. Employees need to know the risks specific to their job, how to read warning signs, what to do during an incident, and how to report afterward. Training happens at hire, when job conditions change, and at least once a year.

5. Incident reporting and recordkeeping. Every violent incident, threat, and near-miss gets recorded. OSHA's recordkeeping regulation (29 CFR 1904) already requires logging workplace violence injuries that hit recordability thresholds ^[6]. Your violence program should go past that and capture threats and near-misses too, even when nobody gets hurt.

6. Program evaluation and revision. You review the program at least yearly and after every serious incident. What changed? What controls worked? What didn't? A static document that never changes is a red flag in an OSHA inspection.

Those six are not optional extras. They are exactly what OSHA looks for when it investigates a complaint or a serious incident at a retail location.

How do you conduct a retail worksite violence hazard analysis?

The hazard analysis is the section most programs botch. People download a template, check boxes, and call it done. That is not an analysis. An analysis produces findings specific to your store.

Start with your incident history. Pull three to five years of workers' comp claims, police reports, and any informal logs supervisors keep. If you have never tracked this, the absence of records is itself a finding, and your program should fix that going forward. Look for patterns: what time of day, which spot in the store, which type of customer interaction, which employees.

Next, walk the physical space with someone who works there. You are hunting for areas where employees work alone with no sightline to colleagues, cash-handling points visible to customers, parking lot conditions after dark, entry and exit points that are hard to watch, and break rooms or offices where an employee could get trapped. Document what you see. Take photos. Measure travel distances to exits if it matters.

Then talk to employees. Front-line retail workers know which customers have made threats, which hours feel unsafe, and which procedures they skip because they are impractical. Ask open questions. You will learn more in a ten-minute conversation with a closing-shift cashier than in an hour of reviewing generic checklists.

Compare your findings to industry benchmarks. OSHA's late-night retail guidelines and BLS data both show violence risk spikes after 9 PM, during cash-counting periods, and near transit hubs or areas with high drug activity ^[5][1]. If your store shares those traits, say so in the analysis.

Write it up in plain language. The hazard analysis section should read like a memo from someone who actually visited the store, because that is what it should be. The more specific it is, the more defensible it is if OSHA reviews it, and the more useful it is to the managers who have to put the controls in place.

What engineering and administrative controls work in retail settings?

Controls are where the program turns into real change. OSHA's guidance for retail violence names these engineering controls as feasible and effective for late-night retail ^[5]:

• Drop safes and limited cash access: keeping cash in the register below $50 and posting signs that say so
• Physical barriers: service windows, counters, or partitions that put distance between employees and customers
• Closed-circuit television cameras covering entrances, registers, and parking areas
• Height markers on exit doors so employees can give accurate descriptions after incidents
• Panic buttons or silent alarms tied to a monitoring service or police
• Convex mirrors to kill blind spots in aisles
• Outdoor lighting that actually covers parking areas and approaches to the building

Control Type	Example	Cost Range (rough)	Effectiveness Evidence
Drop safe with signage	Limited-cash policy, posted notice	$200, $800	Reduces robbery motivation; cited in OSHA late-night retail guidance [5]
CCTV system	4 to 8 camera setup with DVR	$800, $3,000 installed	Deterrence and post-incident evidence
Panic button/alarm	Monitored wireless panic device	$30, $100/month	Enables rapid police response
Improved exterior lighting	LED fixtures covering lot	$500, $2,500	Reduces ambush risk; standard crime prevention through environmental design recommendation
Two-employee minimum (nights)	Scheduling policy change	Labor cost only	Addresses isolation risk; included in OSHA guidance [5]

Administrative controls matter just as much. A two-employee minimum for high-risk hours is one of the most cited controls in OSHA guidance for retail. Policies about not confronting shoplifters, cash-counting done away from customer view, and protocols for employees arriving and leaving after dark all count as administrative controls.

Personal protective equipment is rarely the right primary answer for violence in retail. Body armor for convenience store clerks is not a reasonable primary control. PPE comes last in the hierarchy and should never substitute for engineering and administrative fixes.

Here is what I would actually do first: install the drop safe and post the signage. The evidence that reducing perceived cash availability deters robbery attempts is strong enough that OSHA calls it out by name, and it costs less than a day's wages.

What training does OSHA require for retail workplace violence prevention?

OSHA sets no training-hour minimum for workplace violence in retail under the General Duty Clause. California's Title 8 Section 3342 requires training at hire, annually, and whenever the program changes, but it mandates no specific duration ^[4]. What OSHA's guidance does say is that training must cover topics relevant to the employee's actual work situation ^[5].

For a retail employee, that means the training covers:

• The types of violence that happen in retail and the risk factors specific to this location
• How to recognize escalating behavior and warning signs before violence starts
• De-escalation technique: tone, body language, creating distance, not arguing over merchandise
• The company policy on shoplifter confrontation (most loss-prevention experts recommend a strict no-physical-confrontation rule for floor staff)
• How to respond during a robbery or assault: cooperate, do not resist, observe details for later
• How and where to report threats, incidents, and near-misses afterward
• What resources exist post-incident, including employee assistance programs

For managers, training adds how to investigate and document incidents, how to run a threat assessment when an employee reports a concern about a specific person (a stalker, an angry ex-partner), and when to bring in law enforcement.

Delivery format affects retention but OSHA does not dictate it. In-person scenario-based training beats video alone for behavioral skills like de-escalation. That said, a well-built online module with a knowledge check is far better than no training at all. The OSHA training options now include short, modular formats that fit shift-based retail staff.

Document every session. Date, content covered, trainer name, and the list of employees who attended. That documentation is what you hand over when OSHA asks to see your training records during an inspection. A training that was not documented might as well never have happened.

How should a retail store handle incident reporting and recordkeeping for violence?

Your program needs two parallel recordkeeping tracks: the OSHA 300 Log (required by 29 CFR 1904 for establishments with 11 or more employees in most industries) and your internal violence incident log, which should capture far more than the OSHA 300 wants ^[6].

OSHA 300 recordability for violence injuries follows the same rules as any other injury: the case must be work-related, a new case, and meet at least one recording criterion (days away from work, restricted duty, medical treatment beyond first aid, loss of consciousness, or a significant injury diagnosed by a healthcare professional) ^[6]. A robbery where nobody gets hurt does not go on the OSHA 300. A robbery where an employee ends up with a broken wrist does. Fatalities and hospitalizations run on a faster clock: OSHA requires you to report any work-related fatality within 8 hours and any in-patient hospitalization within 24 hours ^[6].

Your internal log should capture everything, including incidents that miss OSHA recordability. A customer threatening to "come back and kill" a cashier is a near-miss for a fatal violence event. A shoplifter who shoves an employee but leaves no injury is still a violent incident. Log the date, time, location in the store, names of people involved, what happened, witnesses, and what action was taken. This log becomes the data source for your annual review. It also becomes the evidence that you knew about a hazard if something worse happens later and you did nothing. So log everything and act on the patterns.

Employees need a clear, easy, no-consequences way to report. A physical form at the manager's desk works. A QR code linking to a Google Form works. What does not work is a verbal "just tell your manager" policy with no paper trail, because informal reports vanish. Make the incident report process part of new hire orientation so it isn't an afterthought.

Post-incident support belongs here too. Employees who experience or witness violence should have access to counseling and a debrief with their manager. Some state workers' comp programs and most employee assistance programs (EAPs) cover short-term counseling. Put the contact information in your program document.

Does OSHA require a written violence prevention program for retail specifically?

Under federal OSHA and the General Duty Clause, no regulation says "retail employers must have a written workplace violence prevention program." What exists is OSHA's power to cite you under Section 5(a)(1) for failing to address a recognized hazard, plus guidance that a written program with the six elements above is the expected control for that hazard ^[5].

In practice, when OSHA investigates a serious violence incident at your store, the first thing the inspector asks for is your written program. No program means the hazard was not being addressed. A program that is clearly generic and never tailored to your location weakens your defense. A real, site-specific program with training records and incident logs shows good faith even when something went wrong.

California is the exception. Cal/OSHA's Title 8 Section 3342, effective July 1, 2024, requires all covered California employers (retail included) to have a written Workplace Violence Prevention Plan as a specific regulatory requirement, more than good practice ^[4]. The plan has to be in writing, site-specific, and available to employees.

Several other state-plan states, including Washington and Oregon, have their own guidelines for violence prevention in retail that go past the federal baseline. If you operate in a state-plan state, check your state's OSHA equivalent. The OSHA state plan map is a good starting point for figuring out whether your state has stricter requirements.

What does an OSHA inspection look for in a retail violence prevention program?

OSHA compliance officers investigating a violence complaint or serious incident at a retail location generally check the same things in roughly this order.

First, do you have a written program? Is it signed? Is it dated? Does it name a coordinator? Is it specific to this location, or is it obviously a template nobody ever customized?

Second, what does your incident history show? They will ask for your OSHA 300 Log and any internal incident records. A run of logged incidents with no matching changes to controls is a serious red flag.

Third, what physical controls are in place? They look at camera coverage, lighting, register configurations, and whether posted notices about limited cash are actually present and accurate.

Fourth, what are your policies? They ask to see your shoplifter confrontation policy, your after-dark closing procedures, and your cash-handling rules. If your written policy says "do not confront shoplifters" but employees report they are expected to stop people at the door, there is a gap.

Fifth, what training have you done? They ask for training records. Dates, content, attendance. If your last training was three years ago and you have had three violence incidents since then, that is a problem.

Sixth, how do you handle reports? They ask employees whether they feel comfortable reporting threats and what happens when they do.

A General Duty Clause citation requires OSHA to prove four things: the employer failed to keep the workplace free from a hazard; the hazard was recognized; the hazard caused or was likely to cause death or serious physical harm; and a feasible, useful method existed to correct it ^[3]. A well-documented, actively maintained program attacks every one of those points. It does not guarantee you will never see a citation. It is the only realistic defense you have.

How do you write the program document itself?

The document does not need to be fancy. Thirty to fifty pages of dense legal language will not get read by anyone. What you want is a clear, direct document of ten to fifteen pages that employees can actually follow.

Here is a structure that works:

Cover page: Store name, address, date written, name and title of the person responsible for the program, signature.

Policy statement: Two or three paragraphs stating that the company takes workplace violence seriously, that retaliation against reporters is prohibited, and who owns the program. This is where management commitment lives in writing.

Hazard assessment findings: The written output of your site walkthrough and employee interviews. What hazards exist, where, and under what conditions. This section is specific to your location.

Controls in place: Every engineering and administrative control currently running, with a short note on what hazard it addresses. Then any control gaps the assessment found, plus a target date for fixing each one.

Training plan: Who gets trained, on what, by whom, how often, and how it is documented. Include the content outline for your sessions.

Reporting procedures: Step-by-step instructions for reporting a threat or incident. Include the form or the link to the form. Name the person who receives the report and what happens next.

Recordkeeping: Where records live, how long you keep them, who reviews them.

Emergency procedures: What to do during an active incident. Keep this very short and action-oriented. Nobody reads a paragraph during a robbery.

Post-incident response: What the company does after an incident for affected employees, including EAP contact information.

Annual review: A signature page for each annual review, with the date and any changes made.

If you want a head start, SafetyFolio's program generator walks you through each section with retail-specific prompts and outputs a formatted document you can customize. Useful for skipping the blank page.

Whatever you use to build it, the document has to match your actual store. If it says you have panic buttons and you don't, or claims a two-person closing policy you have never enforced, it creates liability instead of reducing it.

How often does a retail violence prevention program need to be reviewed and updated?

At minimum, once a year. That is the standard in OSHA's guidelines and the explicit requirement under California's Title 8 Section 3342 ^[4][5].

Beyond the annual review, update the program any time one of these happens: a violent incident occurs at your location; your physical layout or staffing model changes materially; you open or close a shift time that shifts your risk profile; the person responsible for the program changes; or local crime statistics move materially.

The annual review should be a real meeting, not a rubber stamp. Pull your incident log from the past year. Count incidents by type and time of day. Then ask: did the controls we have actually work? Were there incidents the controls did not stop? Did employees use the reporting process? Were there barriers to reporting?

Document the review with the same discipline you use for training: date, who participated, what was reviewed, what changed (or a note that nothing changed and why). Sign it.

A program reviewed and updated consistently over three years, even an imperfect one, looks dramatically better in an OSHA inspection than a newer program nobody has touched since the day it was written. The revision history is evidence of an active safety culture, not a document written once to satisfy a checkbox.

What about threat assessment and domestic violence spill-over in retail?

Two hazard categories retail programs miss entirely: targeted threats from specific individuals, and domestic violence that follows employees to work.

Targeted threats happen when a customer, former employee, or known individual makes specific threats against an employee or the store. These need a different response than general robbery prevention. If an employee tells you a customer has threatened them three times, you need a written response plan: documentation of the threat, notification to other staff who might run into the person, an assessment of whether a trespass notice fits, and in serious cases, law enforcement or a threat assessment professional.

Domestic violence drives a real share of workplace homicides. The Bureau of Labor Statistics has consistently found that intimate partner violence accounts for a disproportionate share of workplace homicide among women ^[1]. Retail, with predominantly female workforces in many segments, is directly exposed. Your program should have a confidential process for an employee to disclose that they are in a dangerous domestic situation, so the store can act: alerting security or the team to watch for the abuser, adjusting shift assignments, refusing to release schedule information over the phone, and connecting the employee with resources.

This does not turn you into a social services provider. It takes a manager trained to listen without judgment, a referral list of local resources (the National Domestic Violence Hotline is 1-800-799-7233), and a documented protocol. Most states also have workplace domestic violence resources through their labor departments.

Both categories belong in your hazard assessment section by name, with controls that address them specifically. A program that only covers stranger robbery is not finished.

Are there state laws beyond OSHA that affect retail violence prevention programs?

Yes, and this is where the rules are changing faster than most retail operators realize.

California's Title 8 Section 3342, effective July 1, 2024, is the most specific standard currently in force for general industry including retail ^[4]. It requires a written Workplace Violence Prevention Plan, a violence incident log (separate from the OSHA 300), annual employee training with specific content requirements, and post-incident response procedures. Cal/OSHA can issue citations with specific penalties under this regulation, more than under the General Duty Clause.

Washington State's Division of Occupational Safety and Health has had guidelines for violence prevention in late-night retail for years, and Washington is a state-plan state where state standards apply rather than federal OSHA ^[10].

New York has targeted violence prevention requirements for healthcare but not yet for general retail. Illinois, Massachusetts, and Oregon are among the states that have explored or proposed retail-specific violence prevention rules.

The trend runs toward more specific state requirements, not fewer. If you operate in multiple states, your program template needs a review against each state's current rules. OSHA's state plan website lists all 26 state-plan states and their agencies, which is the right starting point for multi-state operators ^[10].

Workers' compensation law in your state may create indirect requirements too. In some states, a documented violence prevention program affects subrogation rights, premium calculations, or your legal defenses in civil suits after a workplace violence incident. Your workers' comp carrier is a reasonable first call on that question.

Frequently asked questions

Is a written workplace violence prevention program legally required for retail stores?

Under federal OSHA, no specific regulation requires a written program for retail. But OSHA can cite you under the General Duty Clause (Section 5(a)(1) of the OSH Act) if violence is a recognized hazard and you have no controls. California requires a written plan explicitly under Title 8 Section 3342 as of July 1, 2024. Other state-plan states have their own rules. In practice, the written program is your main defense during any OSHA investigation.

What CFR regulation covers workplace violence in retail?

There is no dedicated CFR section for retail workplace violence. OSHA enforces through Section 5(a)(1) of the OSH Act (the General Duty Clause) and points to its own guidance: "Guidelines for Workplace Violence Prevention Programs for Late-Night Retail Establishments." California retail employers are also subject to California Code of Regulations Title 8 Section 3342, effective July 1, 2024, which is a state-plan standard.

How long should workplace violence training be for retail employees?

OSHA does not specify a duration for General Duty Clause-based violence training in retail. California's Title 8 Section 3342 requires training at hire, annually, and when the plan changes, but mandates no hours. Content matters more than length. A 60 to 90 minute session covering risk factors, de-escalation, robbery response, and reporting is a reasonable floor. For managers, add a module on threat assessment and incident investigation.

What should a retail store do immediately after a violent incident occurs?

Immediately: get medical attention for anyone injured, call police if a crime occurred, and secure the scene. Within 24 hours: document the incident in your internal violence log and check whether it meets OSHA 300 recordability criteria. A fatal incident must be reported to OSHA within 8 hours; an in-patient hospitalization within 24 hours. After: debrief the involved employees, offer EAP referrals, and run a program review to see whether a control failed.

Can OSHA fine a retail store for not having a violence prevention program?

Yes, through the General Duty Clause. OSHA has cited retail employers for failing to address workplace violence as a recognized hazard. Penalties under the General Duty Clause follow the same structure as other OSHA violations: up to $16,550 per serious violation and up to $165,514 for willful or repeated violations as of 2024 (these amounts adjust annually for inflation). California employers face Cal/OSHA penalties under the specific Title 8 Section 3342 standard.

What is a violence incident log and how is it different from the OSHA 300 log?

The OSHA 300 log records recordable work-related injuries and illnesses, including violence injuries that cause days away from work, restricted duty, or medical treatment beyond first aid. A violence incident log is a broader internal record you keep for all violent incidents, threats, and near-misses, even ones that cause no injury. California explicitly requires a separate violence incident log under Title 8 Section 3342. For any retail program, the internal log is the data source that drives your annual review.

Do part-time and temporary retail workers need to be included in violence prevention training?

Yes. OSHA's General Duty Clause obligation covers all employees, including part-time and temporary workers. If a staffing agency places workers in your store, there is a shared employer responsibility: your store controls the worksite hazards, so you handle site-specific training. The staffing agency typically handles general safety onboarding. Your violence prevention training should happen before a temp employee works a solo shift or a late-night shift.

What is the best way to handle a shoplifter confrontation policy under a violence prevention program?

Most safety and loss-prevention professionals recommend a written policy that bars floor-level employees from physically stopping, restraining, or chasing shoplifters. The liability and injury risk of confrontation consistently outweighs the value of recovered merchandise. Your policy should state it plainly: observe, document, do not confront, notify management or security. Train employees on this at hire and reinforce it annually. If you have dedicated loss-prevention staff, their procedures need separate, specialized training.

How do you address domestic violence that spills into the retail workplace?

Build a confidential disclosure process into your program so employees can report that an intimate partner may show up at work. Train managers to respond without judgment. Steps can include not releasing the employee's schedule over the phone, alerting other staff to watch for the individual, adjusting shift times or work locations temporarily, and providing referrals to the National Domestic Violence Hotline (1-800-799-7233). Document the disclosure and the actions taken, and keep that documentation confidential.

How much does it cost to implement a retail workplace violence prevention program?

Writing the program costs time, not money, unless you hire a consultant (rates run $1,500 to $5,000 for a site-specific program). Engineering controls like drop safes ($200 to $800), improved lighting ($500 to $2,500), and CCTV systems ($800 to $3,000 installed) are one-time capital costs. Training can run internally at low cost once the content is built. Administrative controls like a two-person closing policy carry a labor cost that depends on your wages and scheduling. First-year implementation for a single location usually runs $2,000 to $8,000 depending on what you already have.

How often should a retail violence prevention program be reviewed?

At minimum, annually. Also after any violent incident at your location, after significant changes to your physical space or staffing model, and after any change in who owns the program. California's Title 8 Section 3342 requires annual review explicitly. Document every review with a date, participant names, findings, and any changes made. A program showing three years of consistent annual reviews with documented updates is far more defensible than a newer document nobody has revised.

What records do I need to keep for my retail violence prevention program and for how long?

Keep your written program and all prior versions indefinitely, or at least five years. OSHA 300 logs must be retained for five years under 29 CFR 1904.33. Training records should be kept at least three years, and longer is better. Your internal violence incident log should be kept five years minimum. California's Title 8 Section 3342 requires the violence incident log to be kept for five years and the written plan to be available to employees on request.

Can I use a generic template for a retail workplace violence prevention program?

A template is a starting point, not a finished product. OSHA's own guidance and California's Title 8 Section 3342 both require the program to be specific to your worksite. A generic template that has never been customized to your store's layout, hours, incident history, and workforce will not satisfy either the General Duty Clause standard or state-specific requirements. Use a template to understand the structure, then replace every generic section with information specific to your location.

What is the General Duty Clause and how does it apply to retail violence?

Section 5(a)(1) of the Occupational Safety and Health Act of 1970 requires every employer to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." Workplace violence in retail meets the recognized-hazard test because industry data (BLS), OSHA's own guidance documents, and widespread incident history all establish that retail workers face elevated violence risk. OSHA has cited retail employers under this clause when no prevention program existed and a preventable incident occurred.

Sources

1. Bureau of Labor Statistics, Injuries, Illnesses, and Fatalities program: BLS reported 20,050 nonfatal workplace violence injuries requiring days away from work in trade, transportation, and utilities in 2022; BLS data also shows intimate partner violence accounts for a disproportionate share of workplace homicides among women.
2. OSHA, 29 CFR 1910.1030 Bloodborne Pathogens standard: OSHA has specific standards for bloodborne pathogens (1910.1030) but no equivalent dedicated retail violence standard.
3. Occupational Safety and Health Act of 1970, Section 5(a)(1), via OSHA.gov: The General Duty Clause requires employers to furnish a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm."
4. OSHA, Guidelines for Workplace Violence Prevention Programs for Late-Night Retail Establishments: OSHA's late-night retail guidance lays out six program elements and identifies specific engineering and administrative controls as feasible and effective, including drop safes, cash-limit signage, CCTV, lighting, and two-employee staffing.
5. OSHA, Recordkeeping regulation 29 CFR 1904: 29 CFR 1904 requires employers with 11 or more employees to record work-related injuries including violence injuries meeting recordability thresholds; fatalities must be reported within 8 hours and in-patient hospitalizations within 24 hours.
6. OSHA, Workplace Violence overview page: OSHA identifies retail as a high-risk industry for workplace violence and provides industry-specific guidance under the General Duty Clause framework.
7. OSHA, Occupational Safety and Health Act (complete text): OSHA has authority to cite employers under Section 5(a)(1) for failure to address recognized workplace violence hazards even without a specific standard.
8. OSHA, OSHA Penalties: Serious violations carry penalties up to $16,550 per violation; willful or repeated violations up to $165,514 as of 2024, adjusted annually for inflation.
9. OSHA, State Plans page: 26 state-plan states operate their own OSHA programs with standards that may exceed federal requirements; Washington and California have retail-specific or general-industry violence prevention requirements.