Law, duties and violence prevention programs

Robbery and customer aggression are not just bad luck. In both countries, the law treats violence from the public as a workplace hazard that employers must assess and control, the same way they must deal with wet floors or unguarded machines. This lesson explains the main legal duties that apply to stores, the parts of a violence prevention program, and the roles of the employer, supervisors, workers and the safety committee. HSE-108 covers violence and harassment law in depth for every kind of workplace; here we focus on what it means for a store like Northfield Market.

The general duty

The federal Occupational Safety and Health Act has no specific workplace violence standard for retail. Instead, OSHA relies on the General Duty Clause, section 5(a)(1), which requires employers to keep the workplace free of recognized hazards that are causing or likely to cause death or serious physical harm. OSHA has used the General Duty Clause to cite employers where violence was a recognized hazard and feasible controls existed but were not used. Several states go further with their own rules, and Washington, where Northfield operates, has both a general accident prevention program rule and a specific rule for late-night retail.

The rules where Northfield operates

Washington's core safety rules require every employer to have a written accident prevention program tailored to the hazards of the workplace (WAC 296-800-140). Where violence from customers is a recognized hazard, as it is in most stores, the program should address it. Washington also has a chapter specifically for late-night retail, WAC 296-832, titled late night retail worker crime prevention. It applies to retail businesses open during late-night hours and requires crime prevention training for employees and annual retraining, a safe in the store to limit cash, a posted notice about the safe and the limited cash in the register, and outside lighting. Lesson 5 returns to these measures.

Injuries from violence are recorded on the OSHA 300 log like other work injuries when they meet the recording criteria, and Washington employers report serious injuries to the Division of Occupational Safety and Health (DOSH) within set time limits. Bullying and harassment by customers can also fall under discrimination law where it is based on a protected characteristic, which Lesson 10 covers. Fuel stations and convenience stores open late have their own long history of rules and guidance, which HSE-352 covers in detail.

Other examples worth knowing

Rules elsewhere show the range of approaches and are useful for stores that operate in more than one place.

• California: SB 553, signed in 2023, added section 6401.9 to the Labor Code. Since July 1, 2024 nearly every California employer has had to have a written workplace violence prevention plan, train employees, keep a violent incident log and keep records. Cal/OSHA must adopt a general industry standard by December 31, 2026; a revised draft was out for comment in mid-2026.
• New York: the Retail Worker Safety Act requires retail employers with ten or more employees to have a written workplace violence prevention policy and training. Amendments in 2025 moved the policy and training dates to June 2025 and replaced the original panic-button rule with silent response buttons that summon internal help, required from January 1, 2027 for retailers with 500 or more retail employees in the state.
• Florida: the Convenience Business Security Act sets security measures for convenience stores, which Lesson 5 describes.
• OSHA guidance: OSHA's Recommendations for Workplace Violence Prevention Programs in Late-Night Retail Establishments (updated 2009) is not a regulation, but it describes the program elements OSHA expects and is often used as the benchmark for General Duty Clause cases.

The parts of a violence prevention program

Whatever the jurisdiction, a good program for a store has the same building blocks. HSE-108 describes them for workplaces in general. In retail they look like this:

Hierarchy of controls applied to violence

The hierarchy of controls used for physical hazards also works for violence, with some adjustments. Elimination might mean not handling cash at a particular desk, or not opening a stand-alone kiosk late at night. Substitution might mean switching to cashless payment at self-checkouts or selling high-value items from locked cases. Engineering controls include store layout, sightlines, lighting, barriers, time-delay safes, cameras and alarm systems. Administrative controls include staffing levels, cash limits, procedures for refusals and returns, opening and closing routines and training. Personal protective equipment has a small role in retail; for security staff it may include protective vests or gloves, but for most store workers the main personal control is a way to call for help quickly, such as a radio, a personal alarm or a silent response button.

As with other hazards, controls higher up the list are more reliable because they do not depend on a worker doing the right thing under stress. Training in de-escalation is valuable, but it works best when the store design and procedures have already reduced the number of tense situations workers face.

Roles and responsibilities

The employer is responsible for the program: assessing risk, providing controls and training, keeping records and making sure incidents are followed up. Supervisors put the program into practice on each shift. They make sure staffing and cash limits are followed, back up workers in difficult interactions, take reports seriously, make sure injured or shaken workers get care, and pass information up the chain. Workers follow procedures, report incidents and concerns, take part in training and use the tools provided, such as alarms and radios. They also have the right to refuse work they reasonably believe is dangerous, which can include being sent alone to deal with a threatening person.

In Washington, employers with 11 or more employees generally need a safety committee, and smaller employers can hold safety meetings instead. The committee reviews incident reports and the accident prevention program and recommends improvements, and violence incidents should be part of that review.

Information about people with a history of violence

Some laws require employers to tell workers about a person with a known history of violence whom they are likely to meet at work, sharing only the information needed to protect them. In a store this might be a customer who has been banned after assaulting a worker, or a person subject to a no-trespass notice. A short, private briefing for affected staff, with a description and what to do if the person returns, meets the need without broadcasting personal information. Privacy law still applies, so the store should share only what workers need to stay safe and keep records secure.

A simple program gap check

A quick way to see where a store stands is to score each program element on a simple scale and look for the gaps. The program below does that for Northfield using the elements in the table. Scores are Marco's judgment from his first review: 0 means missing, 1 partly in place and 2 fully in place.

# Violence prevention program gap check for Northfield Market (Spokane).
# Scores: 0 = missing, 1 = partly in place, 2 = fully in place (Marco's first review).
elements = {
    "Policy in accident prevention program": 2,
    "Written risk assessment": 1,
    "Store safety measures (safe, notice, lighting)": 1,
    "Crime prevention training and annual retraining": 1,
    "Post-incident medical referral": 0,
    "Reporting, OSHA 300 recording and investigation": 1,
    "Support after incidents": 1,
    "Safety committee review and annual review": 0,
}
total = sum(elements.values()); best = 2 * len(elements)
print(f"Program score: {total} of {best} ({100 * total / best:.0f}%)")
for name, s in sorted(elements.items(), key=lambda kv: kv[1]):
    flag = "GAP" if s == 0 else ("partial" if s == 1 else "ok")
    print(f"  {s}  {flag:<7} {name}")
gaps = [n for n, s in elements.items() if s == 0]
print("Fix first:", "; ".join(gaps))

Program score: 7 of 16 (44%)
  0  GAP     Post-incident medical referral
  0  GAP     Safety committee review and annual review
  1  partial Written risk assessment
  1  partial Store safety measures (safe, notice, lighting)
  1  partial Crime prevention training and annual retraining
  1  partial Reporting, OSHA 300 recording and investigation
  1  partial Support after incidents
  2  ok      Policy in accident prevention program
Fix first: Post-incident medical referral; Safety committee review and annual review

Northfield scores about half. It has a policy, but the risk assessment is out of date, procedures exist only for some desks, training is inconsistent, injured workers are not routinely advised to see a doctor, and nobody reviews the program as a whole. The gaps are typical. Many stores have a policy written by head office but little behind it at the store level. The rest of this course fills those gaps one at a time.

For supervisors: what the law expects of you on a shift

You do not need to memorize section numbers. You do need to know that violence is a recognized hazard in your store, that procedures exist for robbery, refusals and aggressive customers, and that you are expected to follow them and make sure your team does. On each shift, check staffing against the plan, check that cash limits are being followed, know where the alarms are, back up workers who are dealing with difficult customers, and take every report seriously. If a worker is hurt or badly shaken, make sure they get care and that the incident is reported and investigated.