Sarbanes-Oxley and OSHA

THE DUTY OF CARE THAT REACHES YOUR PEOPLE

AND WHAT CHANGED IN 2026

Most leaders treat Sarbanes-Oxley and OSHA as paperwork. They are something considerably larger. Together, these two laws set the duty of care that decides whether an organization protects its people or answers for the harm that reaches them.

The books and the people answer to the same duty. Sarbanes-Oxley guards the honesty of financial reporting. OSHA guards the safety of everyone who walks through the door. Ignore either one and the risk lands on both sides of the house.

What Changed in 2026

On February 13, 2026, the U.S. Court of Appeals for the Tenth Circuit decided Cedar Springs Hospital v. OSHRC, No. 24-9519, with a companion ruling the same day in UHS of Delaware v. OSHRC, No. 24-9521. The court upheld OSHA’s authority to cite an employer over workplace violence under the General Duty Clause, 29 U.S.C. 654(a)(1), and it did so even though OSHA has never issued a workplace violence standard at all.

The hospital argued that the Centers for Medicare and Medicaid Services already governed its safety obligations, so OSHA should stand down. The court rejected it. Oversight of patient safety does not displace the duty owed to the employees.

Read that part twice. The absence of a specific standard has never been the absence of a duty.

The Honest Other Half

These cases remain hard to win. In December 2024, an administrative law judge at the Occupational Safety and Health Review Commission vacated a General Duty Clause citation against a private security company whose officer was shot and killed by an armed patron at a mall in Boise. OSHA had argued the company repeatedly exposed its officers to a recognized hazard and failed to follow its own procedures for approaching armed individuals. The judge was not persuaded.

The record cuts both ways. Anyone who tells you the law now guarantees a citation after an attack is selling something, and it is worth being careful about who is doing the telling. What the 2026 rulings actually changed is narrower, and more useful: an employer can no longer end the conversation by calling an attack unforeseeable. The question has moved to whether a workable control existed and went unused.

That question gets harder to answer well every year, because the controls keep improving.

Where the Hard Requirements Actually Live

Federal law sets a general duty. State law is where specific, enforceable workplace violence requirements have arrived, and they arrived fast.

California, Senate Bill 553

Since July 1, 2024, nearly every California employer has been required to write, adopt and implement a Workplace Violence Prevention Plan. The plan has to name who is responsible for carrying it out, set out how reports are accepted and answered, prohibit retaliation against the person who reports, and describe how the organization responds when violence is happening or about to. Training is required when the plan is established and every year after that. Records are required. Penalties run from $18,000 to $25,000 per violation, and the Occupational Safety and Health Standards Board has until December 31, 2026 to adopt the formal standard.

New York, the Retail Worker Safety Act

Retail employers with ten or more employees in New York must adopt a workplace violence prevention policy and run a training program. The required curriculum names active shooter drills and emergency procedures directly. Employers with fewer than fifty retail employees train every two years; everyone above that trains at hire and annually. A February 2025 amendment replaced the original panic button with a silent response button that alerts on-site security, managers and supervisors rather than off-site police, required of employers with 500 or more retail employees statewide, effective January 1, 2027.

Two states, two different rules, two different deadlines, two different triggers based on headcount. An organization operating in both complies with both. This is the shape of what is coming, and it is not going to get simpler.

Why Waiting for the Law Is the Wrong Test

A mandate is a floor. It describes the least an organization can do without being punished, which is a strange thing to aim at when the subject is whether people go home at the end of a shift.

Prevention does not need a statute to justify it. It needs to work. The P.R.O. Model™ is a national standard selected by the U.S. Department of Justice for 2022, 2025 and again for 2026, 2030. The P.R.O. Model™ is also in use at some installations and commands across the Department of Defense. None of that happened because a law compelled it. It happened because prevention, response and options, applied in that order, reduce the number of people an attacker can reach.

There is a practical argument too. An organization that has already built the program simply documents what it has when a requirement lands. The one that waited begins at zero, on someone else’s deadline, while being examined.

The Sarbanes-Oxley Act, and Why It Exists

Congress passed the Sarbanes-Oxley Act in 2002, after the Enron and WorldCom collapses wiped out investors, pensions and thousands of jobs. It carries the names of Senator Paul Sarbanes and Representative Michael Oxley, the two men who wrote it. The goal was honest financial reporting and real accountability at the top, and the act created the Public Company Accounting Oversight Board to keep auditors honest about it.

The law runs to eleven titles. For most leaders the sections carrying the most weight are 302, 401, 404, 409, 802 and 906.

What Compliance Costs, and Who Feels It

The U.S. Government Accountability Office studied the real cost of compliance and published its findings as Sarbanes-Oxley Act: Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones. Larger nonexempt companies paid roughly 19 percent more in overall compliance costs. When a growing company crossed the threshold, audit fees jumped a median of $219,000 in that first year, and smaller companies felt every dollar of it.

Size does not excuse the duty. It only changes how the weight feels.

Where Sarbanes-Oxley and OSHA Meet

Security sits underneath most of what Sarbanes-Oxley asks for, because accurate reporting depends on controlled systems and on a workforce able to do its job. A written, credible security policy is one of the first things an auditor, a regulator or opposing counsel will ask to see, and one of the fastest things to produce if it already exists.

OSHA arrives from the other direction. The General Duty Clause requires an employer to keep the workplace free from recognized hazards likely to cause death or serious physical harm. Targeted violence is a recognized hazard. It has been for years, and the 2026 rulings make that harder to argue with.

Train, Inform, Reassess

Three obligations sit inside that duty, and they are not complicated. Train the people who need to know the real risks and the steps that reduce them. Tell your workforce what has been done to lower the danger and exactly how to report a hazard or an incident. Then reassess on a schedule, because threats change and training goes stale faster than anyone expects. Repeat the training whenever procedures or risks change.

The Real Cost of Doing Nothing

When prevention gets skipped, the bill still arrives. It arrives later, and it arrives larger. What an attack actually costs an organization:

  • Customers take their business elsewhere, whether or not the attacker had any connection to the company.
  • Business continuity breaks across the whole enterprise, reaching employees, investors, operations and revenue.
  • Productivity and confidence drop hard, and they stay down.
  • Death and injury drive liability, workers’ compensation and litigation.
  • Property damage can close a site for weeks.
  • Recruiting and retention suffer for years, because people remember.

Every one of those costs is measurable after the fact. Measuring prevention before the fact is the harder discipline, and the one that matters.

What To Do Now

  1. Find out which laws reach you. Headcount, state and industry all change the answer, and a multi-state employer usually has more than one answer.
  2. Put the plan in writing. Name the owner. An unwritten plan is not a plan, and it will not survive a records request.
  3. Build the reporting path, then protect it. People report when reporting is safe and simple.
  4. Train, and keep the records. Dates, attendance, content. The documentation is the proof.
  5. Reassess on a calendar, not on a feeling.
  6. Understand the difference between prevention and response. Most programs sold as prevention are response with better marketing.

Your Sarbanes-Oxley and OSHA Duty of Care

The law is moving. It is inconsistent between states, contested in federal court, and years away from settling. Deciding what to do about violence in your workplace by watching that process is a poor way to make the decision.

The better question is the one a jury, a regulator and your own people will all ask afterward, and they will ask it in the same words. Was there something reasonable you could have done, and did you do it?

Chris Grollnek is Chairman of the Board & Founding Principal of the Active Shooter Prevention Project, LLC (ASPP™™™), a former U.S. Marine and retired police detective corporal, and the creator of the P.R.O. Model™.