The publication is in the public domain
The report states that the publication is in the public domain.
This publication is in the public domain.
NCIER®
Statement claims
Every claim in the map classified as statement, in report order.
Claims
Authorization is granted to copy and distribute the publication in whole or in part
Authorization to copy and distribute the publication, in whole or in part, is granted.
Authorization to copy and distribute this publication in whole or in part is granted.
Secret Service star insignia may not be reproduced without advance written permission
The U.S. Secret Service star insignia may not be otherwise reproduced or used in any other manner without advance written permission from the agency.
However, the U.S. Secret Service star insignia may not be otherwise reproduced or used in any other manner without advance written permission from the agency.
Required citation: National Threat Assessment Center (2026), Preventing Targeted Workplace Violence
Reprinting needs no permission, but when quoting, paraphrasing, or referring to the report, the citation should be National Threat Assessment Center (2026), Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management, U.S. Secret Service, Department of Homeland Security.
While permission to reprint this publication is not necessary, when quoting, paraphrasing, or otherwise referring to this report, the citation should be: National Threat Assessment Center. (2026). Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management. U.S. Secret Service, Department of Homeland Security.
Workplace violence harms tens of thousands of people each year
Workplace violence is a significant and persistent challenge, harming tens of thousands of people and impacting numerous organizations and communities each year.
Workplace violence is a significant and persistent challenge, harming tens of thousands of people and impacting numerous organizations and communities across the nation each year.
Severe workplace attacks target places where people routinely work
Some of the most severe acts of workplace violence are premeditated attacks on places people routinely work and visit, including offices, restaurants, hospitals, hotels, schools, and factories.
Some of the most severe acts of workplace violence are premeditated attacks targeting the places where we routinely work and visit
Targeted workplace violence causes trauma, injury, and loss of life
Acts of targeted workplace violence are devastating, resulting in trauma, injury, and loss of life.
The consequences of these acts of targeted workplace violence are devastating to our nation, resulting in trauma, injury, and most tragically, loss of life.
Preventing targeted violence in workplaces requires a team approach
Preventing targeted violence in workplaces requires a team approach.
Preventing targeted violence in our workplaces requires a team approach
NTAC offers a blueprint for workplace safety programs
NTAC offers a blueprint to help agencies, organizations, and workplaces ensure the safety of their workforce and the public.
we offer a blueprint to support agencies, organizations, and other workplaces as they work tirelessly to ensure the safety of their workforce
Risk management should always be driven by the behavioral threat assessment results
Risk management should always be driven by the results of the behavioral threat assessment.
Risk management should always be driven by the results of the behavioral threat assessment.
NTAC's mission pairs prevention research with guidance and training
NTAC's mission to prevent targeted violence involves publishing research and guidance for public safety partners, supported by training and consultation.
involves the publication of research and guidance for our public safety partners across the United States
Targeted violence includes attacks on officials, schools, houses of worship, workplaces
Targeted violence takes multiple forms, including attacks targeting government officials, schools, houses of worship, and workplaces.
Targeted violence encompasses multiple forms of violence that have impacted communities across the nation, including attacks targeting government officials, schools, houses of worship, and workplaces.
NTAC launched a project on targeted violence in workplace settings
NTAC developed a dedicated project to understand and prevent targeted acts of violence within workplace settings.
NTAC developed a project specifically aimed at understanding and preventing targeted acts of violence within workplace settings
Report is written for organizational safety stakeholders across functions
The publication supports organizational safety stakeholders in management, security, human resources, information technology, cybersecurity, and insider threat roles.
to support organizational safety stakeholders in a variety of professional roles, including those responsible for management, security, human resources, information technology, cybersecurity, and insider threat
Report also targets law enforcement, mental health, and community partners
The publication is also intended for people with broader public safety responsibility, including state and local law enforcement, mental health professionals, and other community partners.
It is also intended for individuals with broader public safety responsibility, including state and local law enforcement, mental health professionals, and other community partners.
Preventing targeted workplace violence is everyone's responsibility
Preventing targeted workplace violence is everyone's responsibility.
Preventing targeted workplace violence is everyone's responsibility.
All employees, including supervisors and HR staff, have a prevention role
All employees, from supervisors and managers to front-line staff and security or HR professionals, have a role to play in violence prevention.
All employees, including supervisors, managers, front-line employees, and professionals in security, human resources (HR), and other positions and departments, have a role to play in violence prevention.
Violence prevention includes recognizing and reporting concerning behaviors for many employees
For many employees, violence prevention includes recognizing and reporting concerning behaviors they observe so action can be taken before violence occurs.
For many employees, this includes recognizing and reporting concerning behaviors they observe so action can be taken to intervene before violence can occur.
Part 1 examines attackers' background and behavioral history
Part 1 presents NTAC research findings on mass attacks in workplace settings, including attackers' background characteristics and behavioral history.
mass attacks perpetrated in workplace settings, including the background characteristics and behavioral history of the attackers
Part 2 offers a scalable 8-step BTAM framework
Part 2 describes BTAM principles and offers a scalable 8-step framework for organizations of differing sizes and resources.
offer a scalable 8-step framework to assist organizations of differing sizes and resources to take proactive action and reduce the risk of targeted workplace violence
Publication offers research findings and operational guidance on targeted workplace violence
The publication offers key research findings and operational guidance for preventing acts of targeted workplace violence.
This publication offers key research findings and operational guidance for preventing acts of targeted workplace violence.
Publication is designed to help establish a program to proactively prevent workplace violence
The publication is designed to promote organizational safety by offering information and guidance that can be used to establish a program to proactively prevent incidents of targeted workplace violence.
This publication is designed to promote organizational safety by offering information and guidance that can be used to establish a program to proactively prevent incidents of targeted workplace violence.
Part 2 guides implementing an organizational BTAM program based on the Secret Service approach
Part 2, A Guide for Workplace Violence Prevention, is a guide to implementing an organizational behavioral threat assessment and management (BTAM) program based on the proactive violence prevention approach used by the U.S. Secret Service.
A guide to implement an organizational behavioral threat assessment and management (BTAM) program based upon the proactive approach to violence prevention used by the U.S. Secret Service.
Overview presents findings on attack characteristics and attackers' backgrounds and behavior
The section presents findings on the characteristics of the attacks and on the backgrounds and behavioral histories of the attackers.
We present findings on the characteristics of the attacks and the backgrounds and behavioral histories of the attackers.
Training all employees to recognize and report concerning behaviors is critical
It is critical that all employees and other members of the workplace are trained to recognize and report concerning behaviors so appropriate action can be taken.
It is critical that all employees and other members of the workplace are trained to recognize and report concerning behaviors
Organizations can implement a BTAM program to identify, assess, and manage concerns
The report describes how organizations can successfully implement a behavioral threat assessment and management program to identify individuals of concern, gather information to assess risk, and manage concerns.
we describe how organizations can successfully implement a behavioral threat assessment and management program to identify individuals of concern
Preventing targeted violence is possible with the right tools and training
The Secret Service recognizes that preventing targeted violence is possible if communities are equipped with the appropriate tools, training, and resources to recognize warning signs and intervene, namely through behavioral threat assessment and management (BTAM).
preventing targeted violence is possible if communities are equipped with the appropriate tools, training, and resources to recognize warning signs and intervene, namely through behavioral threat assessment and management
cite page 30 Part 2: A Guide for Workplace Violence Prevention
BTAM is typically conducted by a multidisciplinary team responsible for identify, assess, manage
The BTAM process is typically conducted by a multidisciplinary team of personnel with diverse backgrounds, experience, and expertise, who take principal responsibility for identifying, assessing, and managing potential individuals of concern.
The BTAM process is typically conducted by a multidisciplinary team comprised of personnel with diverse backgrounds, experience, and expertise, who take principal responsibility for identifying, assessing, and managing potential individuals of concern.
cite page 30 Part 2: A Guide for Workplace Violence Prevention
BTAM is a systematic risk management approach
BTAM involves determining if an individual of concern poses a risk of violence. It also requires developing proactive management strategies to reduce the likelihood of a violent outcome.
Is a systematic risk management approach. BTAM involves determining if an individual of concern poses a risk of violence while developing proactive management strategies to reduce the likelihood of a violent outcome.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
BTAM requires corroboration from diverse sources beyond the individual
The BTAM team should evaluate information from others who know the individual, as well as lawfully accessible records and social media, not only interviews with the individual.
the BTAM team should also evaluate information obtained from others who know the individual (e.g., colleagues, supervisors, family members), as well as lawfully accessible information contained in records, social media activity, and other forms of documentation.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
BTAM team should use rapport building to support positive engagement
A BTAM team should employ rapport-building techniques to facilitate positive engagement and successful intervention.
A BTAM team should employ rapport-building techniques to facilitate positive engagement and successful intervention.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
Acting on early concerning behavior improves chances of preventing violence
Acting at the first sign of concerning behavior, rather than waiting for a direct or explicit threat, improves the chances of preventing violence.
Acting at the first sign of concerning behavior, instead of waiting for a direct or explicit threat, improves the chances of preventing violence.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
BTAM offers early intervention before behavior escalates to violence
The BTAM process offers an opportunity to apply appropriate interventions before behavior escalates to criminality or violence.
The BTAM process offers an opportunity to apply appropriate interventions before behavior escalates to criminality or violence.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
BTAM does not rely on demographic profiling
Rather than focusing on demographic characteristics, the BTAM process prioritizes understanding an individual's thinking and behavior.
Rather than focusing on demographic characteristics (e.g., gender, age, race, ethnicity), the BTAM process prioritizes understanding an individual's thinking and behavior.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
BTAM is not prediction; it targets factors that drive violence
Rather than attempting to predict who will act violently, the BTAM process should focus on identifying and addressing the concerning factors that appear to drive a person toward violence.
Rather than attempting to predict who will act violently, the BTAM process should focus on identifying and addressing the concerning factors that appear to drive a person toward violence.
cite page 31 Part 2: A Guide for Workplace Violence Prevention
Framework presents steps personnel can implement to reduce targeted workplace violence risk
The framework presents practical steps workplace personnel can implement to identify, assess, and manage individuals of concern, thereby reducing the risk of targeted workplace violence.
presents practical steps that workplace personnel can implement to successfully and proactively identify, assess, and manage individuals of concern, thereby reducing the risk of targeted workplace violence.
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Eight-step framework gives a scalable roadmap for BTAM programs
The eight foundational steps provide a practical roadmap for establishing a BTAM program that organizations can adapt to their size, structure, and resources.
provide a practical roadmap for establishing a BTAM program that organizations can adapt to their size, structure, and resources
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 1: Commit to Employee Safety and Support
Step 1 of the Framework for Prevention is to commit to employee safety and support.
STEP 1 | Commit to Employee Safety and Support
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 2: Establish BTAM Program Policy and Procedures
Step 2 of the Framework for Prevention is to establish BTAM program policy and procedures.
STEP 2 | Establish BTAM Program Policy and Procedures
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 3: Assemble a Multidisciplinary BTAM Team
Step 3 of the Framework for Prevention is to assemble a multidisciplinary BTAM team.
STEP 3 | Assemble a Multidisciplinary BTAM Team
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 4: Identify and Process Reports of Concerning Behavior
Step 4 of the Framework for Prevention is to identify and process reports of concerning behavior.
STEP 4 | Identify and Process Reports of Concerning Behavior
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 5: Gather Information to Assess for Risk
Step 5 of the Framework for Prevention is to gather information to assess for risk.
STEP 5 | Gather Information to Assess for Risk
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 6: Develop Risk Management Strategies
Step 6 of the Framework for Prevention is to develop risk management strategies.
STEP 6 | Develop Risk Management Strategies
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 7: Promote a Safe and Supportive Organizational Climate
Step 7 of the Framework for Prevention is to promote a safe and supportive organizational climate.
STEP 7 | Promote a Safe and Supportive Organizational Climate
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Framework Step 8: Provide Training for All Employees
Step 8 of the Framework for Prevention is to provide training for all employees.
STEP 8 | Provide Training for All Employees
cite page 32 Part 2: A Guide for Workplace Violence Prevention
Adopting a prevention mindset is an important first step
Adopting a prevention mindset through a commitment to employee safety and support is an important first step to reduce the risk of targeted violence in the workplace.
Adopting a prevention mindset through a commitment to employee safety and support is an important first step to reduce the risk of targeted violence in the workplace.
Commitment is shown through leadership, resources, collaboration, and partnerships
The commitment can be demonstrated by securing leadership support, providing resources and direction, promoting collaboration between employees, and building outside partnerships.
This commitment can be demonstrated by securing leadership support for workplace safety efforts, providing resources and direction to employees, promoting collaboration and coordination of safety efforts between employees, and building partnerships with others outside of the organization's walls.
A BTAM program is a worthy investment offering direct benefits
A BTAM program is a worthy investment for many organizations, offering critical direct benefits such as reduced risk of harm or loss of life.
A BTAM program is a worthy investment for many organizations, offering critical direct benefits, such as the reduced risk of harm or loss of life
Targeted workplace violence can be prevented when organizations commit to proactive prevention
Targeted workplace violence can be prevented when organizations commit to a proactive approach to violence prevention.
Targeted workplace violence can be prevented when organizations commit to a proactive approach to violence prevention.
Senior leadership support can be of paramount importance to BTAM
Support from senior leadership can be of paramount importance to the development of an effective BTAM program.
Support from senior leadership can be of paramount importance to the development of an effective BTAM program.
Leaders who support prevention are instrumental in allocating resources and staffing to BTAM
Leaders who actively support violence prevention are instrumental in ensuring that resources, funding, and staffing are allocated appropriately and that BTAM work is prioritized.
Leaders who actively support violence prevention efforts are instrumental in ensuring that resources, funding, and staffing are allocated appropriately and that the work of the BTAM program is prioritized.
Most larger organizations already have internal personnel who can help
Most larger organizations already have internal personnel who can help prevent violence.
Most larger organizations already have internal personnel who can help to prevent violence.
Many organizations offer Employee Assistance Programs for distressed staff
Many organizations offer Employee Assistance Programs (EAPs) that can provide counseling and support to employees experiencing distress.
Many organizations also offer Employee Assistance Programs (EAPs), which can provide counseling and support for employees experiencing distress.
Evaluate internal resources as an early step in the BTAM process
One early step organizations may take is to evaluate the internal resources that may be leveraged during the BTAM process.
One early step that organizations may take is to evaluate the internal resources that may be leveraged during the BTAM process.
Organizations should improve resource quality and availability once assessed
Once it is understood which resources are and are not available, organizations should improve their quality or availability and ensure necessary services are available when needed.
Once it is understood what resources are and are not available, organizations should take action to improve the quality or availability of these resources and ensure that necessary services and supports are available when needed.
A resource inventory identifies needs, use, quality, and gaps
Completing a resource inventory (see Figure 5) can help organizations identify which needs resources are designed to address, how often they are available and/or used, how well they address intended needs, any barriers or gaps in services, and what actions can be taken to enhance services.
Completing a resource inventory (see Figure 5) can help organizations identify which needs the resources are designed to address
Internal resources include managers, HR professionals, and ombudsmen who can mediate conflict
Internal personnel resources can include workplace managers, human resource (HR) professionals, or an ombudsman, all of whom can mediate conflict.
These resources can include workplace managers, human resource (HR) professionals, or an ombudsman, all of whom can mediate conflict.
Organizations should inventory all of their available resources
The sample gives three examples of resources organizations may use in the BTAM process. Organizations should complete this type of inventory to assess all of their available resources.
Organizations should complete this type of inventory to assess all of their available resources.
All employees have a role in preventing violence at work
All employees have a role in preventing violence at their workplace.
All employees have a role in preventing violence at their workplace.
Collaboration across components can greatly benefit the BTAM process
Strong collaboration between employees across varying components within an organization can greatly benefit the BTAM process by safeguarding work environments.
Strong collaboration between employees across varying components within an organization can greatly benefit the BTAM process by safeguarding work environments.
Establish partnerships before a crisis requires them
Partnerships should be established before a time of need to support streamlined collaboration, information sharing, and crisis response.
Establish partnerships before a time of need to support streamlined collaboration, information sharing, and crisis response.
BTAM processes should build relationships before services are needed
BTAM processes should incorporate strategies to foster collaboration, starting with building relationships before services are needed.
Build relationships before services are needed.
BTAM processes should incorporate specific strategies to foster collaboration
BTAM processes should incorporate a set of strategies to foster collaboration across the organization.
BTAM processes should incorporate the following strategies to foster collaboration:
Meet employees where they are and explain BTAM and their role
Employees benefit from an explanation of the BTAM process, how it can help, and their role in it. Outreach should focus on safety, violence prevention, and employee support.
Employees will benefit from an explanation of the BTAM process, how it can help, and their role in the process.
HR personnel should know what employee information can and cannot be shared
HR personnel should know what employee information can and cannot be shared, when, and with whom. HR personnel should also understand the job functions and needs of collaborators on the BTAM team.
personnel should know what employee information can and cannot be shared, when information can be shared, and with whom information can be shared.
Lead with compassion and avoid an excessive focus on punishment
Language centered on supporting, helping, and caring for others can engage colleagues and avoid an excessive focus on punishment and reprimand.
Adopting language centered on supporting, helping, and caring for others can be effective in engaging colleagues, educating them on the principles of the BTAM process, and avoiding an excessive focus on punishment and reprimand.
Approach partners with humility; BTAM aims to help, not take over
The BTAM process will have the most success by reassuring employees that its goal is to help rather than to take over the work of other organizational components.
The BTAM process will have the most success by reassuring employees that the goal of the process is to help, rather than to take over the work of other organizational components.
Clear communication can help establish goal alignment and clear roles
Clear communication can help parties understand each other's missions, highlight goal alignment, and establish clear roles, responsibilities, and expectations.
Clear communication can help all parties understand each other's mission and function, highlight points of goal alignment, and establish clear roles, responsibilities, and expectations.
Collaboration strategy: meet audiences where they are
One collaboration strategy is to meet audiences where they are.
Meet audiences where they are.
Tailor BTAM messages to employees' perspectives, focusing on safety, prevention, and support
When approaching employees, consider their unique perspectives and what information they need, focusing on the principles of safety, violence prevention, and employee support.
When approaching employees, consider their unique perspectives and what information they need to know, focusing on the principles of safety, violence prevention, and employee support.
Collaboration strategy: clarify the capabilities of collaborators
Another collaboration strategy is to clarify the capabilities of collaborators.
Clarify the capabilities of collaborators.
BTAM participants should understand each role and what each can and cannot contribute
Those involved in the BTAM process should have a clear understanding of everyone's role and how they can and cannot contribute.
Those involved in the BTAM process should have a clear understanding of everyone’s role and how they can and cannot contribute.
HR should understand BTAM collaborators' functions and how each side can aid the other
HR personnel should also understand the job functions and needs of BTAM team collaborators, including how HR can assist them and how they might aid HR in its BTAM role.
HR personnel should also understand the job functions and needs of collaborators on the BTAM team, including how they can assist collaborators, and how collaborators might aid them in their role in the BTAM process.
Collaboration strategy: lead with compassion, empathy, and care
Another collaboration strategy is to lead with compassion, empathy, and care.
Lead with compassion, empathy, and care.
Collaboration strategy: approach prospective partners with humility and intent to help
Another collaboration strategy is to approach prospective partners with humility and the intent to help.
Approach prospective partners with humility and the intent to help.
A helping approach fosters trust and long-lasting collaboration
Reassuring employees that BTAM aims to help rather than take over fosters trust with colleagues and lays the groundwork for long-lasting collaboration.
This approach fosters trust with colleagues and lays the groundwork for long-lasting collaboration.
Collaboration strategy: establish goal alignment and clear roles
Another collaboration strategy is to establish goal alignment and clear roles.
Establish goal alignment and clear roles.
Organizational components differ in their goals and functions
Different organizational components vary in their goals and functions.
Different organizational components vary in their goals and functions.
Community partnerships are crucial to organizational BTAM success
Establishing partnerships with community agencies, such as law enforcement, social services, or mental health professionals, is crucial to the success of organizational BTAM efforts.
Establishing partnerships with community agencies, such as local law enforcement, social services, or mental health professionals, is crucial to the success of organizational BTAM efforts.
Community agencies can effectively supplement organizational BTAM efforts
Community agencies can be highly effective resources in supplementing an organization's efforts to identify, assess, and manage concerning individuals.
Community agencies can be highly effective resources in supplementing an organization's efforts to identify, assess, and manage concerning individuals.
Formalize partnership agreements such as MOUs
Written partnership agreements that describe activities and information sharing can help resolve challenges and uncertainty. Some organizations use a memorandum of understanding (MOU).
Clearly describing the activities and parameters of partnering agencies, including when, how, and what information is shared between the agency and the organization, can help resolve challenges and uncertainty during collaboration.
Designate a point of contact for each partner agency
A designated point of contact for a partner agency can limit confusion about who to contact and may result in faster connections during a crisis.
Establishing a designated point of contact for a partner agency. This strategy can limit confusion about who to contact when support is needed and may result in faster connections during a crisis.
Seek-to-understand meetings can help build more fruitful agency partnerships
Hosting or attending seek-to-understand meetings can foster understanding and build a more fruitful partnership with a community agency.
Meeting with a community agency to listen and learn about their organizational goals, viewpoints, needs, challenges, or limitations can help foster understanding and build a more fruitful partnership.
Formalize written partnership agreements with community agencies
Certain strategies may be effective in overcoming partner barriers, including formalizing written partnership agreements that describe when, how, and what information is shared.
Formalizing written partnership agreements.
Why inferred Recommendation hedged by 'may be effective'; quote is the strategy heading only.
Some organizations formalize partnership agreements with a memorandum of understanding
Some organizations have established formal written partnership agreements using a memorandum of understanding (MOU).
Some organizations have established these formal agreements using a memorandum of understanding (MOU).
Partnership strategy: host or attend seek-to-understand meetings
One strategy for fostering cooperation with outside agencies is hosting or attending "seek to understand" meetings.
Hosting or attending “seek to understand” meetings.
Sound programmatic infrastructure is important for targeted violence prevention
Developing sound programmatic infrastructure for a workplace BTAM program is important to creating an effective process for targeted violence prevention.
Developing sound programmatic infrastructure for a workplace BTAM program is important to creating an effective process for targeted violence prevention.
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
BTAM infrastructure should include a policy and SOPs
This infrastructure should include two components: policy and standard operating procedures (SOPs).
This infrastructure should include two components: policy and standard operating procedures (SOPs).
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
Policy establishes the program while SOPs define daily operations and roles
Organizational policy should establish the BTAM program, while SOPs should outline day-to-day operations and the roles and responsibilities of personnel.
Organizational policy should establish the BTAM program, while the program's SOPs should outline the day-to-day operations and the roles and responsibilities for personnel involved in the BTAM process.
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy should be formalized alongside broader workplace violence policies
A BTAM policy should be formalized alongside or within any broader workplace violence policies an organization already has.
A policy establishing the organizational BTAM program should be formalized alongside or within any broader workplace violence policies that an organization already has in place.
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
A dedicated BTAM policy can support a more comprehensive prevention program
A dedicated BTAM policy can help create a more comprehensive prevention program capable of addressing a continuum of behaviors and concerns.
Having a dedicated policy for the BTAM program can help to create a more comprehensive prevention program capable of addressing a continuum of behaviors and concerns.
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
Policy sets clear expectations and a foundation for program details
Policy is important in establishing clear expectations and a foundation upon which the more granular details of the program can be built.
Policy is important in establishing clear expectations and a foundation upon which the more granular details of the program can be built.
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
BTAM policies can build on legislative mandates to promote safety
While these laws do not explicitly require BTAM policies, such policies can build upon legislative mandates and further promote workplace safety.
While not explicitly required by these laws, workplace BTAM policies can build upon these legislative mandates and further promote workplace safety.
cite page 40 Step 2: Establish BTAM Program Policy and Procedures
A BTAM policy should articulate its goals, principles, authority, scope, and placement
A BTAM policy should establish and articulate each of the listed elements. The listed elements begin with goals, principles, team authority, scope, and placement.
A BTAM policy should establish and articulate each of the following:
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should state BTAM goals to give a clear vision
The policy should state the goal of BTAM to establish a clear vision and understanding of the program's intention.
State the goal of BTAM in order to establish a clear vision and understanding of the program's intention.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should state that BTAM covers behavior beyond explicit threats
The policy should articulate key BTAM principles, including that the program addresses any behavior indicating potential risk, not only explicit or direct threats.
state that the program encompasses work to proactively address any behavior that indicates a potential risk to safety and is not limited to explicit or direct threats.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
A multidisciplinary BTAM team should carry out essential functions as best practice
It is best practice that many of the essential functions of the BTAM program be carried out by a multidisciplinary BTAM team.
It is best practice that many of the essential functions of the BTAM program be carried out by a multidisciplinary BTAM team.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should grant the BTAM team authority to act before violence occurs
The policy should establish the BTAM team's authority to perform the functions needed to identify, assess, and manage individuals of concern before violence can occur.
Establish the authority of a BTAM team to perform the necessary functions to allow them to identify, assess, and manage individuals of concern before violence can occur
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should define who is in BTAM scope and what actions may follow
The policy should articulate who is subject to assessment and what actions may be taken, which may include current and former employees, frequent customers, and relatives.
Articulate who will be subject to a behavioral threat assessment and what actions may be taken during the BTAM process.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should specify program placement, integration, and team structure
The policy should establish which department will house the BTAM program and how it integrates, with team structure based on organizational needs.
Establish which organizational department, component, or division (e.g., security, HR) will house the BTAM program and how the BTAM program will be integrated into the organization.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
BTAM team structure should be based on organizational needs
The structure of the BTAM team should be based upon organizational needs; Figure 6 sets out three potential structures (central team, local teams, regional teams with support).
The structure of the BTAM team (see Figure 6) should be based upon organizational needs.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: goals of the BTAM program
The first element a BTAM policy should establish and articulate is the goals of the BTAM program.
Goals of the BTAM program.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy goals can describe dedication to workplace safety and proactive prevention
As an example of a goal statement, the policy can describe the program's dedication to workplace safety and proactive prevention of violence.
For example, describe the program's dedication to workplace safety and proactive prevention of violence.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy should articulate the key principles of the program
A BTAM policy should articulate the key principles of the BTAM program.
Articulate the key principles of the BTAM program.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: authority and staffing of the BTAM team
A BTAM policy should establish and articulate the authority and staffing of the BTAM team.
Authority and staffing of the BTAM team.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should specify core BTAM team roles and ad hoc supporting roles
The policy should specify which departments, roles, and job functions are required to serve as core BTAM team members and which might support the team in an ad hoc capacity (see Step 3).
Specify which departments, roles, and job functions are required to serve as core BTAM team members, and which might support the team in an ad hoc capacity (see Step 3).
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
BTAM scope may cover employees, former employees, customers, visitors, partners, and relatives
Program scope may include current and former employees; frequent or notable customers, clients, patients, and visitors; or current or former romantic partners or relatives of individuals connected to the workplace.
This may include current and former employees; frequent or notable customers, clients, patients, and visitors; or current or former romantic partners or relatives of individuals connected to the workplace.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: program placement and integration
A BTAM policy should establish and articulate the program's placement and integration within the organization.
Program placement and integration.
cite page 41 Step 2: Establish BTAM Program Policy and Procedures
Policy should describe reportable concerns and how employees report them
The policy should describe concerning behaviors that should be reported to the BTAM program and how individuals, especially employees, can report their concerns.
describe concerning behaviors that should be reported to the BTAM program and how individuals, especially employees, can report their concerns.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Policy should set when BTAM convenes and allow a low threshold of concern
The policy should set parameters for when the BTAM team convenes and responds to a report, and should allow a low threshold of concern.
Establish parameters for when the BTAM team will convene and respond to a report. The policy should allow for a low threshold of concern
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Policy should define what behaviors and reports should prompt law enforcement notification
The policy should establish what behaviors and reports should necessitate notification to law enforcement for assistance with a safety concern or a criminal matter.
Establish what behaviors and reports should necessitate notification to law enforcement for assistance with a safety concern or a criminal matter.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Policy should describe safeguards protecting people who share information
The policy should describe what safeguards protect individuals who share information during the BTAM process.
Describe what safeguards are offered to protect individuals who share information during the BTAM process.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Policy should set internal and external information-sharing provisions
The policy should establish provisions for sharing information internally and externally, and describe any public safety exceptions that apply.
Establish provisions for sharing information internally (i.e., between personnel, departments, and divisions) and externally (i.e., with outside partners).
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Sample policy defines a BTAM team mission to identify, assess, and manage risk
A sample policy statement, established within or under a named overseeing department or division, gives the BTAM team the mission to identify, assess, and manage individuals who may pose a risk of harm to themselves or others in the workplace, either currently or in the future.
the mission of the [name of the BTAM team] is to identify, assess, and manage individuals who may pose a risk of harm to themselves or others in the workplace, either currently or in the future.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
SOPs support a thorough, consistent BTAM process across team changes
Developing SOPs can support a thorough, consistent, and standardized BTAM process. It also gives program continuity over time and through changes to team membership.
Developing standard operating procedures (SOPs) can support a thorough, consistent, and standardized BTAM process, and allows for program continuity over time and through changes to team membership.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Written SOPs give team members a shared understanding of expectations
Memorializing detailed SOPs can allow all BTAM team members to share an understanding of what is expected of them and what they can expect from others.
Memorializing detailed SOPs can also allow for all BTAM team members to have a shared understanding of what is expected of them and what they can expect from others on the team.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Documented procedures reveal strengths and areas for improvement
Documenting procedures allows an organization to assess programmatic and procedural strengths and to identify areas for continued improvement.
documenting procedures allows an organization to assess programmatic and procedural strengths and to identify areas for continued improvement.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
SOPs should cover each phase from identification through assessment and resources
SOPs should account for each phase of the BTAM process, including how concerns are identified and reported, how inquiries and full assessments are conducted, and what resources are available.
account for each phase of the BTAM process and what should be accomplished within each phase, including how concerning behaviors will be identified and reported, how the BTAM team will conduct an inquiry or a full assessment
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: receiving reports of concerning behaviors
A BTAM policy should establish how the program receives reports of concerning behaviors.
Receiving reports of concerning behaviors.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: threshold for initiating a BTAM inquiry and response
A BTAM policy should establish the threshold for initiating a BTAM inquiry and response.
Threshold for initiating a BTAM inquiry and response.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: threshold for law enforcement intervention
A BTAM policy should establish the threshold for law enforcement intervention.
Threshold for law enforcement intervention.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
BTAM policy element: explanation of privacy protections
A BTAM policy should include an explanation of privacy protections.
Explanation of privacy protections.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Policy should describe public safety exceptions that facilitate or require sharing
When applicable, the policy should describe public safety exceptions that either facilitate or require information sharing.
When applicable, public safety exceptions that either facilitate or require information sharing should be described.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
SOPs should define actionable tasks, owners, timeframes, and documentation
SOPs should identify actionable steps and tasks, who is responsible for them, timeframes for completion, and documentation requirements.
identify what actionable steps and tasks must be taken to move through the process, who is responsible for completing them, timeframes for completion, and documentation requirements
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
SOPs should set team meeting frequency and meeting leadership
SOPs should establish how often the team meets and who leads the meetings.
establish frequency of team meetings and who leads them
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
SOPs should set improvement cycles and effectiveness data points
SOPs should establish program improvement cycle requirements and identify the data points used to judge program fidelity, effectiveness, and impact.
identify data points that will be used to determine program fidelity, effectiveness, and impact
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
SOPs should include a high-level process map and decision tree
SOPs should include a high-level process map and decision tree illustrating the overall BTAM approach.
include a high-level process map and decision tree illustrating the overall process of the organization's BTAM approach
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
Organizations with existing policies should consider a gap analysis
Organizations that already have workplace violence policies and procedures should consider conducting a gap analysis.
Organizations that already have established workplace violence prevention policies and procedures should consider conducting a gap analysis to:
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
A gap analysis should align policies and identify sources of conflict
The gap analysis should ensure alignment between existing policies and identify sources of conflict that may need to be addressed.
ensure alignment between existing policies;
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
A gap analysis should review resource capacity and evaluate processes to closure
The gap analysis should review resources for capacity-building opportunities and evaluate processes from initial report through case closure.
evaluate current processes, from initial report through case closure, to determine if changes are needed.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
Evaluate program awareness, reporting understanding, and staff training
Organizations should evaluate awareness of the program and employee understanding of their reporting role, and provide training to enhance staff awareness.
It is also important to evaluate organizational awareness of the program, employee understanding of the role they play in prevention through reporting, and to provide training opportunities to enhance staff awareness.
cite page 43 Step 2: Establish BTAM Program Policy and Procedures
Organizations should plan team composition, training, and meeting standards
When developing the BTAM program, organizations should determine the appropriate team composition, set training expectations for members, and set standards for team meetings.
When developing the BTAM program, organizations should invest time in determining the appropriate team composition, establish expectations regarding training for BTAM team members, and set standards for BTAM team meetings.
Workplace BTAM requires a multidisciplinary team
BTAM in the workplace requires a multidisciplinary team to process reports of concerning behaviors, gather information, and implement interventions.
BTAM in the workplace requires a multidisciplinary team to process reports of concerning behaviors
Violence prevention is the responsibility of everyone in a workplace
The responsibility for violence prevention belongs to everyone in a workplace.
The responsibility for violence prevention belongs to everyone in a workplace.
Identify personnel routinely dedicated to BTAM tasks
Best practice is to identify personnel who can be routinely dedicated to the important tasks of the BTAM process.
it is best practice to identify personnel who can be routinely dedicated to the important tasks associated with the BTAM process
Multidisciplinary teams can let varied roles bring unique expertise
A multidisciplinary BTAM team can allow members with varied roles to leverage their unique expertise, perspectives, and skills to prevent violence.
Establishing a multidisciplinary BTAM team can allow team members with varied organizational roles and responsibilities to leverage their unique expertise
The BTAM team is the primary decision-maker throughout the process
The BTAM team serves as the primary decision-maker at every stage of the BTAM process.
The BTAM team serves as the primary decision-maker throughout the BTAM process.
BTAM teams should include a core group of dedicated, trained professionals
A BTAM team should have a core group of dedicated, trained professionals.
BTAM teams should include a core group of dedicated, trained professionals.
Leaders should decide full-time versus collateral team assignment
Leaders should decide whether team members serve full-time or as a collateral or part-time duty.
leaders should determine if individuals will be assigned to a BTAM team in a full-time capacity, or whether team assignment will be a collateral or part-time duty
A senior manager can serve as facilitator, leader, or final decision-maker
A senior-level manager can serve as facilitator, leader, or final decision-maker and can share information across managers and departments.
A senior-level manager can serve in the role of facilitator, leader, and/or final decision-maker
HR can access personnel records and offer insight on conduct and policy
HR can access personnel records, offer insight on employee performance and conduct, utilize safe hiring and firing practices, share knowledge of policies, and assist with employee morale and office culture.
HR professionals can access employee personnel records
Why inferred The quote covers the personnel-records clause; the remaining items are paraphrased from the same HR sentence on the page.
Security can communicate with law enforcement and build safety plans
Security personnel can support communication with local law enforcement, information gathering, physical security responses, and safety plans.
Security personnel can provide support in communicating with local law enforcement
IT can access digital records and limit an individual's system access
IT professionals can access digital records, system access logs, and communication records, and can limit an individual's access to systems and facilities.
IT professionals can also limit an individual's access to systems and facilities
Cybersecurity and insider threat can monitor misuse of employer devices
Cybersecurity and insider threat personnel can monitor inappropriate use of employer-issued electronic devices throughout the BTAM process.
Cybersecurity and insider threat personnel can monitor the inappropriate use of employer-issued electronic devices throughout the BTAM process.
Legal personnel advise on compliance with federal, state, and local law
Legal personnel can advise the BTAM team on compliance with applicable federal, state, and local laws, including privacy, employee rights, and how to properly handle and store documents.
Legal personnel can provide guidance and advice to the BTAM team to ensure compliance with federal, state, and local laws
EAP identifies resources for managing risk posed by individuals of concern
EAP personnel can identify available resources to use when developing a plan to manage risk.
EAP personnel can provide insight into available resources to leverage when developing a plan to manage the risk posed by individuals of concern
Team leader ensures compliance, facilitates meetings, and builds consensus
The BTAM team leader ensures compliance with policies, facilitates team meetings, and helps members reach consensus.
the BTAM team leader is responsible for ensuring compliance with policies and procedures, facilitating team meetings, and helping team members reach consensus
Team leader communicates between the BTAM team and leadership
The BTAM team leader communicates information between the team and organizational leadership when necessary.
the BTAM team leader is also responsible for communicating information between the BTAM team and organizational leadership when necessary
Team composition differs across organizations, tailored to each one's needs
The composition of the BTAM team will differ across organizations and is tailored to each organization's characteristics and needs.
The composition of the BTAM team will differ across organizations, as it is tailored to meet the organization's unique characteristics and needs.
Workplace BTAM teams often include personnel from roles ranging from management to EAP
Workplace BTAM teams often include personnel from management, human resources, security, information technology, cybersecurity and insider threat, legal, and the employee assistance program.
Workplace BTAM teams often include personnel from the following organizational roles:
Management can ensure information is shared between managers and across departments
Management can also ensure that information is shared between managers and across departments, as appropriate.
Management can also ensure information is shared between managers and across departments, as appropriate.
IT can access digital records, system access logs, and communication records
IT professionals can access relevant digital records, system access logs, and electronic and telephonic communication records.
IT professionals can access relevant digital records, system access logs, and electronic and telephonic communication records.
Some roles may hold permanent BTAM seats while others support the process ad hoc
Some of the described roles may have one or more representatives serving as permanent BTAM team members, while other roles may support the BTAM process in an ad hoc capacity.
While some of the roles described above may have one or more representatives that serve as permanent members of the BTAM team, other roles may support the BTAM process in an ad hoc capacity.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Ad hoc participants vary by case and can include community partners
Ad hoc participants can vary by case and across organizations, including departments and community partners.
Ad hoc participants can vary by case and across organizations
Law enforcement can support information gathering and safety response
State and local law enforcement can assist with information gathering, responding to safety concerns, and supporting management strategies.
Law enforcement can assist with information gathering, responding to safety concerns, and supporting management strategies.
Community mental health can explain how mental health affects a case
Community mental health professionals can explain how mental health may affect a case and share knowledge of available resources.
Mental health professionals can provide insight into how mental health may impact a case
Labor relations can advise on grievances, conflicts, and due process
Labor relations can provide insight into employee grievances, conflicts, and disputes, guidance on union contracts, and support for due process.
Representatives from labor relations can provide insight into employee grievances, conflicts, and disputes.
Alternative dispute resolution staff can help with employee negotiations
Alternative dispute resolution personnel, such as an ombudsman or mediator, can help during negotiations between employees, address conflicts and grievances, and offer insight and perspectives about employee behavior.
Personnel who specialize in alternative dispute resolution, including an ombudsman or mediator, can help during negotiations between employees
Ad hoc participants can include organizational departments and community partners
Beyond the roles described earlier, ad hoc participants can include organizational departments and community partners such as state and local law enforcement, community mental health, labor relations, and alternative dispute resolution.
They can also include organizational departments and community partners, such as:
Labor relations can advise on union contracts and support employee due process
Labor relations representatives also offer guidance on contracts between unionized employees and the organization, and support employee due process.
They also offer guidance on contracts between unionized employees and the organization, and support employee due process.
Employees need not be core members to matter to the BTAM process
Employees need not be core BTAM team members to be relevant to the BTAM process.
employees need not be core members of a BTAM team to be relevant to the BTAM process
Ad hoc and other personnel can be critical to identifying and managing concern
Ad hoc participants and other personnel can be critically important when identifying, assessing, and managing individuals of concern.
ad hoc participants and other personnel within the organization can be critically important when identifying, assessing, and managing individuals of concern
Team should engage IT, cyber, chaplain, ombudsman, and labor relations as needed
The BTAM team should engage non-permanent personnel as needed to facilitate information sharing, especially during assessment and management.
the team should engage with these personnel as needed to facilitate information sharing, particularly during the assessment and management processes
BTAM team structures can be adapted to organizational needs
BTAM team structures and the departments involved can be adapted to the unique characteristics and needs of each organization.
these structures can be adapted to meet the unique characteristics and needs of an organization
Figure 7 is just one example of how an organization may staff a BTAM team
Figure 7 illustrates just one example of how an organization may staff a BTAM team and facilitate coordination across personnel and departments.
Figure 7 illustrates just one example of how an organization may staff a BTAM team and facilitate coordination across personnel and departments.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Training is essential for BTAM team members
Training is essential for team members to build and maintain their BTAM knowledge and skills.
Training is essential for ensuring that team members build and maintain their knowledge and skills with BTAM practices.
Team members should receive recurring training on the BTAM process
Team members should receive recurring training on the organization's BTAM process so they understand their roles.
Team members should receive recurring training on the organization's BTAM process
Team members should build skills through comprehensive skill building
Team members should engage in comprehensive skill-building to promote program fidelity and build expertise for effective assessment and management.
They should also engage in comprehensive skill-building to promote program fidelity and build expertise for effective assessment and management.
Training should cover the BTAM process, roles, and information sharing
Training should include an overview of the BTAM process, team roles and responsibilities, how the team operates, and information sharing.
Overview of the BTAM process. This should include information about the BTAM process, including roles and responsibilities
Team members should be trained on what and how to report
Team members should be well trained on what and how behaviors of concern should be reported and how to respond to reports.
BTAM team members should be well-trained in what and how behaviors of concern should be reported in their organization
Team members should know internal and community risk management resources
BTAM team members should be knowledgeable about risk management resources within the organization and in the broader community.
BTAM team members should be knowledgeable about the risk management resources available, both within the organization and the broader community.
Training should cover when and how to contact law enforcement
Training should describe when it is appropriate to contact law enforcement and the procedures to follow once they are contacted.
Training for BTAM members should describe when it is appropriate to contact law enforcement
Training should cover BTAM and intersecting policies and procedures
Training should give an overview of BTAM policies and procedures and related policies such as disciplinary procedures and the emergency response plan.
an overview of the policies and procedures that guide the BTAM team's day-to-day operations
Team members should know municipal, state, and federal law
BTAM team members should be aware of municipal, state, and federal laws, rules, and regulations that apply to their work.
BTAM team members should also be aware of municipal, state, and federal laws, rules, and regulations that apply to their work.
Additional training on mental health and de-escalation can be valuable
Other training, such as mental health, de-escalation, mediation, trauma-informed care, and tabletop exercises, can be valuable to team members.
Other training can be valuable to BTAM team members, including training on mental health
NTAC virtual trainings share decades of targeted-violence research
NTAC's free recurring virtual trainings share findings from decades of research on targeted violence and guidance on using the BTAM process to prevent violence.
During these presentations, NTAC staff share findings from decades of research on targeted violence and guidance on how the BTAM process can be used to prevent future tragedies in our communities.
BTAM team training should cover process, reporting, risk, law enforcement, policy, records, and law
Training content for team members should address an overview of the BTAM process, reporting mechanisms, risk management, contacting law enforcement, BTAM policies and procedures, documentation and records management, and legal and privacy considerations.
Training content for team members should address the following:
Documentation training should cover when forms are required, who completes them, and storage
Documentation training should include when forms are recommended versus required, who must complete the forms, and how the forms should be completed, shared, and/or stored.
This should include when forms are recommended as opposed to when they are required, who must complete the forms, and how the forms should be completed, shared, and/or stored.
BTAM team meetings should be intentional and structured
BTAM team meetings should be intentional and structured.
BTAM team meetings should be intentional and structured.
Team should meet whenever a concerning individual is identified
The BTAM team should meet whenever a concerning individual is identified, to conduct the assessment, share information learned, and develop an individualized case management plan if necessary.
The BTAM team should meet whenever a concerning individual has been identified to conduct the assessment
Scheduled meetings build cohesion, train members, and review cases
The team should hold scheduled meetings regularly to build cohesion, receive training, conduct case reviews, and refine policies.
The BTAM team should also hold scheduled meetings on a regular basis to build cohesion, receive training, conduct case reviews
Regular meetings provide an opportunity for tabletop or role-playing scenarios
Regular meetings provide an opportunity for discussion and tabletop or role-playing scenarios so members are prepared to apply BTAM best practices.
conduct tabletop or role-playing scenarios
Regular meetings may cover case details, challenges and successes, and resource changes
During regular meetings, BTAM team members may share details of a particular case, discuss specific challenges or successes, or offer information about pertinent resources or organizational changes affecting their work.
During these regular meetings, BTAM team members may share details of a particular case, discuss specific challenges or successes encountered, or offer information about pertinent resources or organizational changes that impact their work.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Reporting concerning behavior is one of the most important employee actions
One of the most important actions an employee can take to prevent violence is to report concerning behaviors they witness.
One of the most important actions an employee can take to prevent violence is to report any concerning behaviors they witness.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Organizations should train all employees to recognize and report concern
Organizations should ensure all employees are trained to recognize concerning behavior and have avenues to report safety concerns.
Organizations should ensure that all employees are trained to recognize concerning behavior and have avenues through which they can report their safety concerns.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
BTAM teams should process and triage reports once received
Once a report is received, BTAM teams should process and triage the reports of concern.
Once a report is received, BTAM teams should process and triage these reports of concern
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Identifying and processing reports is the first step of a behavioral threat assessment
Identifying and processing reports of concern is the first step during a behavioral threat assessment.
Identifying and processing reports of concern is the first step during a behavioral threat assessment.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Workforce must be trained to recognize and report concern
Organizations must train their workforce to recognize and report concerns when an individual or situation elicits concern for the safety of themselves or others.
Organizations must train their workforce to recognize and report their concerns when an individual or situation elicits concern for the safety of themselves or others.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
All employees must understand that threatening statements should be reported
All employees must understand that threatening statements should be reported.
All employees must understand that threatening statements should be reported
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
A person may pose a risk of violence without making an explicit threat
A person may pose a risk of violence without ever making an explicit threat.
a person may pose a risk of violence without making an explicit threat
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behaviors occur along a continuum of concern
Concerning behaviors occur along a continuum from contextually concerning to objectively concerning.
concerning behaviors occur along a continuum from contextually concerning to objectively concerning
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behaviors include non-criminal and criminal activities
Concerning behaviors include both non-criminal and criminal activities.
and include non-criminal and criminal activities
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: escalating interpersonal disputes
Escalating interpersonal disputes are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: grievances
Grievances are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: concerning social media content
Concerning social media content is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: stalking and harassment
Stalking and harassment are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: obsessions with violence
Obsessions with violence are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: idolizing past attackers
Idolizing past attackers is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: fixating on people or locations
Fixating on people or locations is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: suicidal ideations
Suicidal ideations are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: self-harm
Self-harm is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: unusual levels of aggression
Unusual levels of aggression are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: threats
Threats are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: weapons violations
Weapons violations are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Concerning behavior: physical assaults
Physical assaults are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Objectively concerning behaviors warrant immediate action
Objectively concerning behaviors such as unauthorized weapons, threats, and assaults should warrant immediate action, often including local law enforcement.
Some behaviors are objectively concerning (e.g., unauthorized weapons, threats, assaults) and should warrant immediate action, oftentimes including local law enforcement intervention.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Contextually concerning behaviors should be assessed in full context
Contextually concerning behaviors, such as rapidly deteriorating performance or angry outbursts, should be assessed in the full context of the person and environment.
Other behaviors are contextually concerning, in that they may not prompt immediate safety concerns but should be assessed in the full context of the individual's situation and their environment
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Employees should be encouraged to report any behavior that makes them uncomfortable
A good guiding principle is that employees should be encouraged to report any observed behavior that makes them uncomfortable or concerned for their own or others' safety.
A good guiding principle is that employees should be encouraged to report any observed behavior that prompts them to feel uncomfortable or concerned for their own safety or the safety of others.
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Employees should receive specific examples of concerning behavior
Employees should be given specific examples of the types of behavior that may prompt these concerns.
Employees should also be provided with specific examples of the types of behavior that may prompt these concerns.
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
IPV can spill out of residences into public spaces
IPV often starts in the privacy of a residence but can spill out into public spaces.
While IPV often starts in the privacy of a residence, it can spill out into public spaces.
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Organizations should be aware of warning signs of IPV
Organizations should be aware of warning signs that could indicate an employee is experiencing IPV.
Organizations should be aware of certain warning signs that could indicate an employee is experiencing IPV
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: decrease in work performance
A decrease in work performance can be a warning sign of IPV. (endnotes 10, 11)
decrease in work performance
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: uncharacteristic absenteeism or lateness
Uncharacteristic absenteeism or lateness can be a warning sign of IPV. (endnotes 10, 11)
uncharacteristic absenteeism or lateness
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: changes in appearance that could conceal injuries
Changes in appearance that could conceal injuries, such as clothing unsuited to the season or changed makeup use, can be a warning sign of IPV. (endnotes 10, 11)
changes in appearance that could conceal injuries
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: increased reluctance to socialize with coworkers
Increased reluctance to socialize with coworkers can be a warning sign of IPV. (endnotes 10, 11)
increased reluctance to socialize with coworkers
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: abrupt change in address or living situation
An abrupt change in address or living situation can be a warning sign of IPV. (endnotes 10, 11)
abrupt change in address or living situation
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: sudden requests to move away from open areas
Sudden requests to move away from open and public areas in the workplace can be a warning sign of IPV. (endnotes 10, 11)
sudden requests to move away from open and public areas in the workplace
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
IPV warning sign: disruptive visits, calls, or messages from a partner
Disruptive visits, phone calls, or messages from a current or former partner can be a warning sign of IPV. (endnotes 10, 11)
disruptive visits, phone calls, or messages from their current or former partner
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Organizations must act immediately when violence in a relationship is suspected
Organizations must take immediate action if an employee is believed to be experiencing violence in a relationship.
Organizations must take immediate action if an employee is believed to be experiencing violence in a relationship
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Provide victims with parking near the building entrance
Organizations can provide victims with parking spaces near the door of the workplace building.
Provide victims with parking spaces near the door of the workplace building
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Offer internal and third-party counseling and mental health services
Organizations can offer internal and third-party services, including counseling and mental health care, to victims.
Offer internal and third-party services, including counseling and mental health care
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Allocate funds for financial support to victims
Organizations can allocate funds for financial support to victims.
Allocate funds for financial support to victims
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Grant flexibility for sick days and personal leave to victims
Organizations can grant victims flexibility in using sick days and personal leave.
Grant flexibility to victims for using sick days and personal leave
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Coordinate with local shelters for victims
Organizations can coordinate with local shelters to identify available openings for victims.
Coordinate with local shelters to identify available openings for victims
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Offer relocation services to victims
Organizations can offer relocation services to help victims move to a new residence.
Offer relocation services to help victims move to a new residence
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Use anonymized work schedules to reduce abuser location risk
Organizations can use anonymized work schedules to decrease the risk of abusers locating victims.
Use anonymized work schedules to decrease risk of abusers locating victims
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Increase physical security presence in impacted locations
Organizations can increase physical security presence in locations affected by IPV.
Increase physical security presence in impacted locations
cite page 52 Step 4: Identify and Process Reports of Concerning Behavior
Victims can get help through the National Domestic Violence Hotline
Anyone experiencing domestic violence can get help through the National Domestic Violence Hotline at 1-800-799-SAFE (7233) or by texting START to 88788.
help is available via the National Domestic Violence Hotline
cite page 53 Step 4: Identify and Process Reports of Concerning Behavior
Organizations must keep a low threshold of concern
It is essential for organizations to keep a low threshold of concern and not limit focus solely to explicit threats of violence.
It is essential for organizations to maintain a low threshold of concern for initiating a behavioral threat assessment and not limit their focus solely to explicit threats of violence.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
A low threshold lets teams act before violence is imminent
A low threshold of concern allows BTAM teams to identify individuals eliciting safety concerns before their behavior escalates to imminent risk of harm.
Utilizing a low threshold of concern allows BTAM teams to identify individuals eliciting safety concerns before their behavior escalates to the point where there is an imminent risk of harm.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
Use a low threshold for early intervention, not labeling
It is best practice to use a low threshold of concern during the BTAM process, not to label someone a potential threat, but to allow early intervention.
It is best practice to use a low threshold of concern during the BTAM process, not to label an individual as a potential threat, but to allow for early intervention.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
Early intervention lets organizations manage risk before violence is imminent
Early intervention lets organizations identify, assess, and manage the possibility of a negative outcome long before violence becomes imminent.
Early intervention enables organizations to identify, assess, and manage the possibility of a negative outcome long before violence becomes imminent.
cite page 54 Step 4: Identify and Process Reports of Concerning Behavior
Individuals must have multiple ways to report concerning behavior
Individuals who recognize concerning behaviors must have multiple avenues available to report them.
Individuals who recognize concerning behaviors must have multiple avenues available to report it.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Reporting is a collective responsibility
Reporting concerning behavior should be seen as a collective responsibility.
Reporting concerning behavior should be seen as a collective responsibility
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Make bystander reporting part of a safe, positive work climate
Organizations should strive to make bystander reporting part of an overall safe and positive work climate.
organizations should strive to make bystander reporting part of an overall safe and positive work climate
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
It is important that employees feel confident reporting without fear of retaliation
It is important that employees feel confident reporting without fear of retaliation or punishment.
It is also important that employees feel confident in reporting without fear of retaliation or punishment.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
All workplaces should have a way to collect concern information
All workplaces should have a means to collect information about concerning behavior.
while all workplaces should have a means to collect information about concerning behavior
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Reporting mechanisms may vary by organization size, type, and industry
The reporting mechanisms employees use may vary based on organization size, type, industry, and other aspects of the work environment.
the reporting mechanisms used by employees may vary based upon a variety of factors, such as the organization size, type, industry
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Choose reporting solutions based on resources, workforce, and context
Organizations must consider available resources, workforce needs, and the unique context of their environment when choosing a reporting solution.
organizations must consider the resources available, the needs across their workforce, and the unique context of their environment
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Toolkit principles are research-based and apply to workplaces
The toolkit's principles are research-based and broadly applicable to reporting mechanisms in other environments, including workplaces.
the principles presented therein are research-based and are broadly applicable to reporting mechanisms established in other environments, including workplaces
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Promote multiple reporting methods to improve accessibility
Organizations should offer simple and accessible means for individuals to share concerns, using more than one reporting avenue.
Organizations should offer simple and accessible means for individuals to share concerns.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Small firms may use email while larger firms may need hotlines or apps
Smaller organizations may use a dedicated email address for concerns, while larger organizations may need a phone hotline, mobile app, or online form.
Smaller organizations with few employees may consider using a dedicated email address where employees can express concerns
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Use training and awareness campaigns to teach what and how to report
Training and awareness campaigns should instruct stakeholders on how and what to report, using posters, brochures, online resources, and training events.
Training and awareness campaigns should be utilized to instruct relevant stakeholders on how and what to report.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Every BTAM member should receive report alerts, even after hours
Every BTAM team member should be able to view received reports and be notified of them automatically, even outside normal hours, if possible.
Every member of the BTAM team should have the capability to view received reports and should automatically be notified of incoming reports, even outside of normal operating hours, if possible.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Some organizations use 24/7 law enforcement or dispatch partners for reports
Some organizations partner with law enforcement or a third-party dispatch center with 24/7 availability to receive reports outside work hours.
partnerships with law enforcement agencies or a third-party dispatch center that has 24/7 availability
Why inferred Describes a practice some organizations use; typed as statement rather than fact.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Checking reports more often speeds response
The more frequently reports are checked, the faster teams can respond to concerns.
The more frequently reports are checked, the faster teams can respond to concerns.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Anonymity and confidentiality can encourage reporting
Anonymity and confidentiality can encourage reporting throughout an organization by making employees feel their privacy is protected.
Anonymity and confidentiality can encourage reporting throughout an organization
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Consider two-way messaging that keeps the reporter anonymous
In some cases, organizations may be able to establish two-way messaging that allows follow-up without requiring the reporter to disclose a name.
organizations may be able to establish two-way messaging that allows follow-up communication without requiring an individual to disclose their name
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Offer anonymous or confidential reporting forms, hotlines, or apps
Other options include anonymous or confidential reporting forms, hotlines, or mobile applications that safeguard the reporter's identity.
Other options include anonymous or confidential reporting forms, hotlines, or mobile applications that safeguard the reporter's identity
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Reporting can be done through a variety of avenues
The report states that reporting can be accomplished through a variety of avenues.
Reporting can be accomplished through a variety of avenues.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Multiple reporting avenues can raise the likelihood employees share concerns
Offering multiple avenues for reporting can increase the likelihood that employees will share their concerns, which enhances the organization's opportunity to take appropriate action.
Offering multiple avenues for reporting can increase the likelihood that employees will share their concerns, thereby enhancing the opportunity for organizations to take appropriate action.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Best practice: set operating hours that improve availability
A listed best practice for workplace reporting systems is to set operating hours that improve availability.
Set operating hours that improve availability.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Reports can be received at any time
The report notes that reports of concern can be received at any time.
Reports can be received at any time.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Best practice: consider an anonymous or confidential reporting option
A listed best practice for workplace reporting systems is to consider an anonymous or confidential reporting option.
Consider an anonymous or confidential reporting option.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Some BTAM teams partner with cyber and IT on specialized detection tools
Some BTAM teams partner with cybersecurity and IT professionals to use specialized technological tools that identify threatening or concerning behavior on organizational networks or devices.
Some organizational BTAM teams partner with cybersecurity and IT professionals to incorporate specialized technological tools to identify threatening or concerning behavior
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Detection tools can run continuously alongside human monitoring
Such tools are autonomous and continuous and can be used with human monitoring to detect and prevent risk of harm. (endnote 13)
can be used in conjunction with human monitoring to detect and prevent risk of harm
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Cyber and IT may set up alerts for anomalous digital behavior
Cybersecurity and IT professionals may set up mechanisms that alert the BTAM team to anomalous digital behaviors.
Cybersecurity and IT professionals may set up mechanisms to alert the BTAM team to anomalous digital behaviors
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Alerts may flag repeated blocked-site visits or unusual device log-ins
Alerts may flag employees who visit blocked or forbidden websites on multiple occasions or log onto devices at unusual times.
employees who visit blocked or forbidden websites on multiple occasions or log onto their devices at unusual times
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Keyword monitoring of searches and internal communications
These tools can perform keyword monitoring of browser searches or internal communications.
These tools can also be used to perform keyword monitoring of browser searches or internal communications
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Flag keywords related to hate speech, weapons, and violence
Keyword monitoring can flag words related to hate speech, weapons, violence, and concerning, inappropriate, or extremist language.
flagging keywords related to hate speech, weapons, violence
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
BTAM teams can use tools to intervene proactively
BTAM teams can use these tools to proactively identify concerning behaviors and intervene.
BTAM teams can use these tools to proactively identify concerning behaviors and intervene.
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Route reports to the correct party in a timely manner
BTAM teams should ensure reports are routed to the correct party so appropriate action can be taken in a timely manner.
BTAM teams should ensure reports are routed to the correct party so appropriate action can be taken in a timely manner.
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Transparency about actions taken can help build trust in the BTAM process
Transparency in communications, including describing actions taken or planned, can build trust and credibility in the BTAM process.
can be an important strategy to build trust and credibility in the BTAM process
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Best practice: field reports in a timely and transparent manner
A listed best practice for workplace reporting systems is to field reports in a timely and transparent manner.
Field reports in a timely and transparent manner.
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Establish how reports are initially processed upon receipt
It is important to establish how reports of concern will be initially processed upon receipt.
It is important to establish how reports of concern will be initially processed upon receipt.
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Triage approach may vary with organization size and staffing
The triage approach may vary with organization characteristics such as size and staffing.
The approach may vary based upon the organization's characteristics, including organizational size, staffing, and other factors.
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Small organizations may send reports directly to the BTAM team
Small organizations may have reports sent directly to the BTAM team for screening and assessment.
small organizations may have reports sent directly to the BTAM team for screening and assessment
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Large organizations can use a preliminary triage process
Large organizations that receive many reports can use a more complex triage process that preliminarily evaluates imminence and relevance to the BTAM team.
large organizations that receive many reports can utilize a more complex triaging process in which reports undergo a preliminary evaluation of their imminence and relevance to the BTAM team
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Reports should be received by trained individuals
Reports should be received by trained individuals who know the BTAM process and understand that even an isolated report may indicate larger risk.
Reports should be received by trained individuals who are familiar with the BTAM process
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
An isolated report may indicate a larger risk
Even an isolated report may be indicative of a larger risk.
even an isolated report may be indicative of a larger risk
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Component differences should inform who processes a concern
One component may be better equipped to evaluate or address a concern than another, and these differences should be considered when routing reports.
one component of the organization may be better equipped to evaluate and/or address a concern than another component
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
An initial screening should follow every report
Once a report is received, an initial screening should be completed.
Once a report is received, an initial screening should be completed.
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Emergency reports go to security or law enforcement, not a BTAM
Reports describing emergencies, such as a terminated employee brandishing a weapon on site, are not appropriate for a BTAM and should prompt an immediate call to security, emergency dispatchers, or local law enforcement.
Reports that describe emergency situations, such as a terminated employee brandishing a weapon on site, are not appropriate for a BTAM
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Screen whether a report is credible
A credible report appears accurate, is submitted in good faith, and includes specific details about the individual of concern and the threat.
The report should appear to be accurate, be submitted in good faith, and include specific details about the individual of concern and the nature of the threat or concern.
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Gather more information when a report's credibility is unclear
If the BTAM team is unsure about a report's credibility, the team should gather additional information until a determination can be made.
If the BTAM team is unsure about the credibility of a report, the team should commence additional information gathering until a determination can be made.
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
A report is actionable if it supports investigation and fits BTAM scope
A report is actionable if it contains enough detail to facilitate investigation and is relevant to the purpose and scope of the BTAM program.
The report should contain enough details about the situation that elicited concern to facilitate further investigation
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Most credible, actionable, non-imminent reports go to the appropriate party, usually the BTAM team
Most non-imminent reports that are credible and actionable should be routed to the appropriate party, usually the organizational BTAM team, for inquiry and assessment.
should be routed to the appropriate party, usually the organizational BTAM team, for inquiry and assessment (see Step 5)
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Some reports need no BTAM action and go to other services
Some cases may need no further BTAM action and may be appropriate for other services or systems.
Other cases may require no further action from the BTAM team, but they may be appropriate for other services or systems.
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Document referrals and preserve records under retention policy
When a report is referred elsewhere, the reason for referral should be documented and records preserved under the organization's retention policy.
the reason for referral should be documented, and the records should be preserved based on the organization's records retention policies
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Initial screening should make three determinations about each report
During the initial screening of a report, three determinations should be made about it: whether it describes an emergency, whether it is credible, and whether it is actionable.
During the initial screening, three determinations should be made about the report:
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Initial screening asks: is the report describing an emergency?
The first initial-screening determination is whether the report describes an emergency.
Is the report describing an emergency?
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Initial screening asks: is the report actionable?
The third initial-screening determination is whether the report is actionable.
Is the report actionable?
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Initial screening asks: is the report credible?
The second initial-screening determination is whether the report is credible.
Is the report credible?
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Executive visibility creates unique safety challenges
Executives' high visibility can present unique safety challenges when individuals harbor grievances against the organization and focus their hostilities on its leadership, making executives vulnerable to stalking, harassment, and targeted attacks.
This visibility can present unique safety challenges when individuals harbor grievances against an organization
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Guidance aims to protect all personnel, including executives
The guidance in this publication is intended to help prevent targeted workplace violence from affecting all personnel, including executives.
The guidance in this publication is intended to help prevent targeted workplace violence from impacting all personnel, including executives.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Some organizations add strategies to protect high-ranking officials
Some organizations use additional strategies to protect high-ranking officials because of the unique characteristics of threats to executives.
some organizations use additional strategies to protect high-ranking officials
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Digital monitoring of platforms for threats against executives
Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats and harassment targeting executives.
Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats, harassment, or other concerning behaviors targeting executives.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Close protection teams guard executives at home, office, and travel
Specially trained security teams can provide physical protection for executives at home, in the office, or during travel.
Specially trained security teams provide physical protection for executives while they are at home, in the office, or during travel.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Travel advances gather intelligence before executive trips
Teams of analysts and security personnel gather intelligence and coordinate security and transportation logistics before an executive's trip and support during it.
Teams of analysts and security personnel gather reliable intelligence and coordinate security and transportation logistics before an executive takes a domestic or international trip
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Some organizations enhance security at executives' homes
Some organizations implement physical security enhancements at an executive's home to bolster protective efforts. (endnote 16)
Some organizations implement physical security enhancements at an executive's home to bolster protective efforts
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Executives' high visibility can attract much public attention
Because of the high visibility of their positions, executives and high-ranking officials can attract a lot of attention from the general public.
Due to the high visibility of their positions, executives and high-ranking officials can attract a lot of attention from the general public.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Travel advance teams provide real-time support during executive trips
During an executive's trip, the travel advance team provides real-time support.
During the trip, the team provides real-time support.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Residential security can include surveillance, alarms, access controls, on-site staff
Physical security enhancements at an executive's home can include surveillance systems, alarms, access controls, and on-site security staff. (endnote 16)
These enhancements can include surveillance systems, alarms, access controls, and on-site security staff.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Actionable reports require a comprehensive evaluation of risk
When actionable reports of concerning behavior are received, BTAM teams must conduct a comprehensive evaluation of the risk posed by the individual.
BTAM teams must conduct a comprehensive evaluation of the risk posed by the individual
Risk assessment should use a fact-based process across diverse sources
BTAM teams should use a fact-based process to gather information from diverse sources, identify key details about the individual's thinking and behavior, and consider the context of the individual's situation.
BTAM teams should use a fact-based process to gather information from diverse sources
The assessment phase determines whether an individual poses risk of harm
The purpose of the assessment phase in BTAM is to determine whether an individual poses a risk of harm to themselves or others.
The purpose of the assessment phase in BTAM is to determine whether an individual poses a risk of harm to themselves or others
Information gathering proceeds in phases: preliminary inquiry, then full assessment
Information gathering can be phased, beginning with a preliminary inquiry and, when appropriate, a full assessment.
Gathering information can be accomplished using a phased procedure beginning with a preliminary inquiry and, when appropriate, conducting a full assessment
BTAM teams should apply the Systems Approach and Assessment Themes
BTAM teams should use the Systems Approach and explore relevant Assessment Themes when gathering information and determining risk.
BTAM teams should utilize the Systems Approach and explore relevant Assessment Themes
Conduct a preliminary inquiry and/or full assessment to understand the individual
To evaluate risk, BTAM teams should conduct a preliminary inquiry and/or full assessment to systematically gather information and develop a comprehensive understanding of the individual of concern's thinking and behaviors.
To accomplish this, BTAM teams should conduct a preliminary inquiry and/or full assessment to systematically gather information to develop a comprehensive understanding of the thinking and behaviors of the individual of concern.
Workplace assessments may draw on sources inside and outside the organization
In workplace settings, the assessment process may involve gathering information from individuals and systems inside and outside the organization and piecing together a comprehensive picture of the individual's behavior and life circumstances so an informed, reliable risk assessment can be made.
In workplace settings, this process may entail gathering information from individuals and systems both inside and outside of the organization, then piecing together a comprehensive picture of the individual's behavior and life circumstances so an informed and reliable assessment of risk can be made.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Preliminary inquiry aims to decide between closing the case and full assessment
The objective of the preliminary inquiry is to establish enough context to decide whether the case should be closed or elevated to a full assessment.
The objective of the preliminary inquiry is to establish enough context to assess whether the case should be closed or elevated to a full assessment
Preliminary inquiry may include interviews with reporter, individual and supervisors
A preliminary inquiry may involve interviews with the reporting person(s), the individual of concern, and others familiar with the situation, such as supervisors or HR.
This process may involve conducting interviews with the reporting person(s), the individual of concern, and others who are directly familiar with the individual or situation
Why inferred 'may' describes an optional method; typed as process guidance rather than conjecture.
Escalate to full assessment if preliminary inquiry shows risk or gaps
If the preliminary inquiry reveals a possible risk of harm or that more information is needed, the BTAM team should proceed with a full assessment.
If the preliminary inquiry reveals that the individual may pose a risk of harm or that more information is necessary to make that determination, the BTAM team should proceed with a full assessment
Full assessment is warranted when the concern bypasses preliminary inquiry
A full assessment is conducted when the reported concern is objectively concerning enough to bypass a preliminary inquiry and move immediately to full assessment.
the reported concern is objectively concerning enough to bypass a preliminary inquiry and move immediately to a full assessment
Full assessment is warranted when preliminary inquiry reveals substantial concern
A full assessment is conducted when the preliminary inquiry reveals a substantial concern.
the preliminary inquiry reveals a substantial concern
Full assessment is warranted when preliminary inquiry yields too little
A full assessment is conducted when the preliminary inquiry alone did not yield enough information to make an assessment of risk.
the preliminary inquiry alone did not yield enough information to make an assessment of risk
Full assessment gathers more detailed information from more diverse sources
A full assessment involves gathering more detailed information from a broader group of people and systems the individual has interacted with.
A full assessment involves gathering more detailed information from more diverse sources
Full assessments typically use interviews, records, social media and devices
A full assessment typically involves multiple interviews, records checks, reviews of publicly available social media, and analysis of employer-issued electronic devices.
A full assessment typically involves multiple interviews, records checks, reviews of publicly available social media, and analysis of employer-issued electronic devices
Full assessment enables an articulable understanding of risk
Gathering this information enables the BTAM team to gain a reasonable and articulable understanding of the risk posed, identify factors specific to the individual that increase or decrease risk, and determine effective strategies to intervene and prevent a potential escalation to violence.
Gathering this information enables the BTAM team to gain a reasonable and articulable understanding of the risk posed
U.S. Secret Service pioneered the Systems Approach
The U.S. Secret Service pioneered the Systems Approach.
the U.S. Secret Service pioneered the Systems Approach
Tiered inquiry-or-assessment approach allocates resources and individualizes response
This tiered approach ensures that resources are allocated appropriately and that every report receives an appropriate individualized response.
This tiered approach ensures that resources are allocated appropriately and that every report receives an appropriate individualized response.
An early BTAM decision: preliminary inquiry or full assessment
One early and necessary determination in the BTAM process is whether a report of workplace concerning behavior needs a preliminary inquiry or a full assessment.
One early and necessary determination in the BTAM process is distinguishing between the need for a preliminary inquiry or a full assessment when responding to reports of concerning behavior in the workplace.
Preliminary inquiry may include review of public social media as needed
Information for a preliminary inquiry may also come from additional sources, such as a review of the individual's publicly available social media, as needed.
Information for a preliminary inquiry may also come from additional sources, for example, a review of the individual's publicly available social media, as needed.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
BTAM effectiveness depends on gathering information from the individual's systems
The effectiveness of the BTAM team depends on its ability to gather substantive information from the people and systems with whom the individual of concern interacts.
The effectiveness of the BTAM team depends upon its ability to gather substantive information from the people and systems with whom the individual of concern interacts.
Systems Approach lets teams synthesize information that would otherwise be siloed
The Systems Approach allows BTAM teams to collect and synthesize pieces of information that may otherwise be siloed.
The Systems Approach allows BTAM teams to collect and synthesize pieces of information that may otherwise be siloed
Synthesizing many sources supports a holistic determination of risk
By using the Systems Approach, BTAM teams can identify and synthesize information from numerous sources to make a holistic determination about risk.
By utilizing the Systems Approach, BTAM teams can identify and synthesize information from numerous sources to make a holistic determination about the risk
Systems Approach can also help identify risk management strategies
The Systems Approach can also be an effective tool for identifying potential risk management strategies.
This approach can also be an effective tool for identifying potential risk management strategies
BTAM teams should have immediate access to internal systems (orange in Figure 10)
A BTAM team should have immediate access to internal workplace systems (shown in orange in Figure 10); external systems (blue) lie outside the workplace.
orange circles represent internal systems to which a BTAM team should have immediate access, while blue circles represent external systems outside of the workplace
General Systems Approach method is constant while specific systems vary
The general method for gathering information using the Systems Approach remains the same for all cases, though the specific systems used may differ from case to case.
the general method for gathering information using the Systems Approach remains the same for all cases
Internal systems are almost always relevant for current or former employees
Internal systems are almost always relevant when assessing an individual who is currently, or has previously been, employed by the organization.
these systems are almost always relevant when assessing and managing an individual of concern who is currently, or has previously been, employed by the organization
For employees, organizational systems will often suffice
For employees, leveraging organizational systems will often be sufficient to assess and manage the risk posed.
leveraging organizational systems will often be sufficient to assess and manage the risk posed
Internal systems can hold information on customers and visitors too
Internal systems can also hold relevant information about other individuals of concern, including customers, clients, visitors, or members of the public.
Internal systems can also have relevant information about other individuals of concern, including customers, clients, visitors, or members of the broader public
Physical security staff may give insight into a disruptive customer
A retail organization assessing a disruptive customer may get valuable insight into the individual's background by speaking with the physical security staff who dealt with them.
may get valuable insight into the individual's background and behaviors by speaking with their physical security professionals
Systems used in an assessment vary with each case's characteristics
The fictional examples described below highlight how different systems may be leveraged depending on the unique characteristics of a case.
how different systems may be leveraged depending on the unique characteristics of a case
Assessing an employee may use different sources than assessing a customer
An organization's assessment of a current employee may look different and may draw on different sources of information than the systems used when assessing a customer.
For instance, an organization's assessment of a current employee may look different and may leverage different sources of information compared to the systems used when assessing a customer.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Teams should examine a variety of internal systems
BTAM teams should gather and examine information from a variety of internal systems that bear on concerning or mitigating information.
BTAM teams should gather and examine information from a variety of internal systems
Supervisors and coworkers can report behavioral change and escalating stress
Employees who interact with the individual may offer observations about past interactions, perceived behavioral changes, and escalating stress or hostility.
Employees who interact with the individual of concern may offer observations and information about past interactions, perceived behavioral changes, and indicators of escalating stress or hostility
Why inferred Descriptive 'may' about information sources; typed as guidance.
HR can supply employment history, conduct, grievances and discipline records
HR professionals may offer information on employment history, work performance, conduct, grievances, conflicts, disciplinary actions, accolades, and attendance records.
professionals may offer information pertaining to the individual's employment history
Physical security can supply incident details, access logs and footage
Physical security personnel may offer behavioral observations, details of security incidents, witness statements, access logs, and security footage.
Physical security personnel may offer behavioral observations, details about security incidents, witness statements, building or facility access logs, and security footage
Why inferred Descriptive 'may' about information sources; typed as guidance.
Legal staff can supply harassment claims, restraining orders and violence records
Legal personnel may offer records of legal filings or complaints, such as harassment claims, restraining orders, and prior violent incidents, and legal rights or protections.
Legal personnel may offer records of legal filings or complaints—such as claims of harassment, restraining orders, and prior violent incidents
IT can provide login history, email and internet usage records
IT may assist with access to system records, including login history, email communications, and internet usage.
IT may assist with access to system records, including login history, email communications, and internet usage
Why inferred Descriptive 'may' about information sources; typed as guidance.
Cybersecurity and insider threat staff can supply user activity monitoring data
Cybersecurity and insider threat professionals may offer data from user activity monitoring, including anomalous digital behaviors such as unauthorized or failed access attempts to restricted systems or files.
Cybersecurity and insider threat professionals may offer data from user activity monitoring
Insider threat and BTAM collaboration can make each more effective
Collaboration between insider threat and BTAM programs can enable each to perform its functions more effectively.
Collaboration and partnership between these programs can enable each to perform their functions more effectively
Insider threat and BTAM programs both detect early red flags and aggregate multi-source data
Both insider threat and BTAM programs are specifically designed to detect early behavioral red flags, aggregate data from multiple sources, and facilitate cross-functional collaboration.
However, both insider threat and BTAM programs are specifically designed to detect early behavioral red flags, aggregate data from multiple sources, and facilitate cross-functional collaboration.
Insider threat programs are well-positioned to help BTAM teams mitigate risk before violence
Because of these shared features, insider threat programs are well-positioned to support BTAM teams in identifying and mitigating risk before it escalates to violence.
These similarities make insider threat programs well-positioned to support BTAM teams in identifying and mitigating risk before it escalates to violence.
Build external collaborative relationships before cases arise
Organizations should preemptively establish collaborative relationships with those outside the organization, as highlighted in Step 1.
This highlights the importance of preemptively establishing collaborative relationships with those outside the organization
Law enforcement coordination can be critical in highly concerning cases
Coordination with law enforcement can be critical, especially in highly concerning cases involving possible violence or criminal behavior or individuals not associated with the organization.
Coordination with law enforcement partners can be critical for organizations
Law enforcement has authority and training to engage outside individuals safely
Law enforcement agencies possess the legal authority, training, and operational protocols needed to safely engage with individuals outside the organization, ensuring that privacy rights are protected and that investigative activity does not escalate the situation or expose the workplace to liability.
Law enforcement agencies possess the legal authority, training, and operational protocols needed to safely engage with individuals outside the organization
Organizations may use law enforcement for protective orders and welfare checks
Organizations may coordinate with law enforcement to serve or enforce a protective order or to request a welfare check at an individual's home.
Organizations may coordinate with law enforcement to serve or enforce a protective order or to request a welfare check
Court records alone do not indicate a threat but can help in context
While court records alone do not indicate a threat, when reviewed in context with other stressors or criminal behaviors they can help BTAM teams identify a history of aggression, violence, or signs of instability or distress.
when reviewed in context with other stressors or criminal behaviors present in the individual's background
Community mental health partners are valuable at nearly any stage
Community mental health partners can be valuable assets at nearly any stage of a behavioral threat assessment.
Community mental health partners can be valuable assets at nearly any stage of a behavioral threat assessment
Public social media posts can reveal grievances, intent and interest in violence
Publicly available posts on social media, forums, or content-sharing platforms can reveal grievances, intent, or interest in violence.
Publicly available posts on social media, forums, or content-sharing platforms can reveal grievances, intent, or interest in violence
Social media may signal crisis and warrant further assessment
Social media content can also contain indicators that an individual is in crisis (e.g., expressions of hopelessness, desperation, pleas for help), which could warrant further assessment.
Social media content can also contain indicators that an individual is in crisis
Open-source investigations expertise can significantly enhance BTAM teams
Including a team member with open-source investigations expertise can significantly enhance a BTAM team's ability to identify digital and online indicators of concern.
Including a team member with expertise in open-source investigations can significantly enhance a BTAM team's ability to identify digital and online indicators of concern
Open-source team members should be trained to gather and analyze ethically
Team members with open-source expertise should be trained to ethically and efficiently find, gather, and analyze publicly available open-source information.
These team members should be trained to ethically and efficiently find, gather, and analyze publicly available open-source information
Community mental health partners offer insight and pathways to evaluation and treatment
These partners can offer valuable insight into potential symptoms and diagnoses, help BTAM teams understand unusual patterns of behavior, and identify avenues for evaluation and treatment.
These partners can offer valuable insight into potential symptoms and diagnoses, help BTAM teams understand unusual patterns of behavior, and identify avenues for evaluation and treatment
Some employees of concern, especially highly concerning ones, may warrant external systems
Some employees of concern, particularly those engaging in highly concerning behaviors, may also warrant the use of external systems to gather information when assessing risk.
Some employees of concern, particularly those engaging in highly concerning behaviors, may also warrant the use of external systems to gather information when assessing risk.
Why inferred Typed statement: 'may also warrant the use of external systems' is guidance on when to use external systems, not a prediction.
BTAM teams may gather information from a variety of external systems
BTAM teams may seek to gather and examine information from a variety of external systems, including law enforcement, judicial, mental health, and online and social media sources.
BTAM teams may seek to gather and examine information from a variety of external systems, including the following:
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Public court records can give context on legal history and other stressors
Publicly available court records such as criminal charges, convictions, protective orders, civil lawsuits, eviction filings, and bankruptcy declarations, found on many judicial and governmental websites, can provide relevant context about an individual's legal history or other stressors.
Publicly available court records (e.g., criminal charges, convictions, protective orders, civil lawsuits, eviction filings, bankruptcy declarations), which can be found on many judicial and governmental websites, can provide relevant context about an individual’s legal history or other stressors.
Mental health professionals can consult on risk, especially in mental health crises
Community mental health professionals can assist in a consultative capacity, using their expertise to assess the risks posed by an individual or situation, particularly where individuals may be experiencing mental health crises.
These professionals can provide assistance in a consultative capacity, leveraging their professional expertise to assess the risks posed by an individual or situation, particularly in cases where individuals may be experiencing mental health crises.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Family and community members may give critical insight in crises
Members of the community, such as family and friends, may offer critical insight into an individual's behavior and circumstances, especially during crises.
Members of the community (e.g., family, friends) may offer critical insight into an individual's behavior and current circumstances
Why inferred Descriptive 'may' about information sources; typed as guidance.
Community interviews occur via law enforcement and only in serious cases
Seeking to interview community members will typically occur by requesting law enforcement support, and only in serious or high-risk situations.
Seeking to interview members of the community will typically occur by requesting the support of law enforcement and only in serious or high-risk situations
Personnel-file emergency contacts may identify family and community members
For current or former employees, emergency contacts in personnel files may help identify family and community members with personal information about the individual.
emergency contacts listed in their personnel file may help BTAM teams identify family and community members who have personal information about the individual
Why inferred Descriptive 'may' about a practical route; typed as guidance.
NTAC presented 20 Assessment Themes built on 25 years of NTAC research and operational expertise
NTAC presented 20 Assessment Themes established by 25 years of NTAC research and the Secret Service's unique operational expertise in violence prevention.
NTAC presented the 20 Assessment Themes that have been established by 25 years of NTAC research
Assessment Themes also identify protective factors
Assessment Themes can also help identify relevant protective factors, which can reduce an individual's risk by bolstering their capacity to cope.
Assessment Themes can also help identify relevant protective factors for an individual of concern
Assessment Themes are not a checklist for predicting violence
Assessment Themes are not intended to be used as a checklist to predict who will engage in violence.
Importantly, Assessment Themes are not intended to be used as a checklist to predict who will engage in violence
Themes separate situational behavior from persistent escalating patterns
The themes allow teams to distinguish situational behaviors, such as temporary frustrations or poor communication, from more persistent, escalating patterns of concern.
these themes allow BTAM teams to distinguish between situational behaviors, such as temporary frustrations or poor communication, and more persistent, escalating patterns of concern
Assessment themes provide a structured framework for gathering information
Instead, these themes provide a structured framework to guide the gathering and integration of information about the individual of concern.
these themes provide a structured framework to guide the gathering and integration of information about the individual of concern
Framework helps look beyond isolated incidents to a broader behavioral context
This framework helps BTAM professionals look beyond isolated incidents and evaluate behavior in a broader context.
This framework helps BTAM professionals look beyond isolated incidents and evaluate behavior in a broader context.
Methodical review prevents decisions based on subjective first impressions
This approach ensures decisions are not made based on subjective judgments or initial impressions, but instead on a comprehensive and methodical review of relevant information.
This approach ensures decisions are not made based on subjective judgments or initial impressions, but instead on a comprehensive and methodical review of relevant information.
Assessment Themes should guide evaluation of behaviors, circumstances and environment
While BTAM teams gather information from internal and external systems, the Assessment Themes should guide evaluation of the individual's behaviors, personal circumstances, and relevant environmental factors that may increase, decrease, or contextualize concern.
While BTAM teams gather information from the internal and external systems relevant to the individual of concern, these Assessment Themes should guide the team’s evaluation of the individual’s behaviors, personal circumstances, and relevant environmental factors which may increase, decrease, or contextualize concern.
Gather both positive and negative contextual details
Gathering both positive details, such as a supportive family, and negative details, such as familial discord, establishes the context of an individual's circumstances.
Gathering both positive details (e.g., caring and supportive family) and negative details (e.g., familial discord and violence) about these factors will establish the context
Criminal behavior may surface through interviews outside formal records
Outside formal records, criminal behavior may be identified during the assessment through interviews with family, friends, coworkers, and others familiar with the individual.
Outside of formal records, criminal behavior may be identified during the assessment through interviews with family, friends, coworkers, classmates, and others familiar with the individual
Why inferred Hedged with 'may be identified'; typed as a process statement about sources.
Behavioral themes alone cannot predict violence but inform management
The presence of behavioral themes alone cannot predict whether an individual will become violent, but it will inform the final assessment and management strategies.
the presence of these behavioral themes alone cannot predict if an individual will become violent
Idolizing or emulating past attackers is of particular concern
Particular concern should arise if the individual idolizes or wants to emulate past attackers.
Particular concern should arise if the individual demonstrates an idolization of or desire to emulate past attackers
Assessing risk centers on behaviors commonly observed in previous attackers
Central to assessing whether an individual poses a risk of targeted violence is understanding the nature of concerning behaviors commonly observed in previous attackers.
Central to assessing whether an individual poses a risk of targeted violence is understanding the nature of concerning behaviors commonly observed in previous attackers.
Fixation on attackers, isolation and violent posts require risk management strategies
As an example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, and has posted concerning violent content on social media, the BTAM team will need to develop appropriate strategies to manage the risk the individual may pose toward the workplace.
For example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, and has posted concerning violent content on social media, the BTAM team will need to develop the appropriate strategies to manage the risk the individual may pose toward the workplace.
Fixations often carry an angry or emotional undertone
Fixations often carry an angry or emotional undertone and may be evidenced through extreme beliefs, grievances, interest in violence or weapons, and stalking or harassing behaviors.
Fixations often carry an angry or emotional undertone
Identifying motive helps teams make a better-informed risk assessment
BTAM teams will be better equipped to make an informed assessment of risk if they have identified what is, or could be, motivating someone to become violent.
BTAM teams will be better equipped to make an informed assessment of risk if they have identified what is, or could be, motivating someone to become violent
Attention should go to whether others fear for their safety
Particular attention should be paid to whether others are in fear for their safety as a result of the individual's behavior.
Particular attention should be paid to whether others are in fear for their safety as a result of the individual's behavior
Weapon access may include relatives' or friends' homes
Access to weapons may include weapons readily available at home, secured or unsecured, as well as weapons in the homes of relatives or friends.
Access to weapons may include those that are readily available to the individual in their home, whether secured or unsecured, as well as those accessible in the homes of relatives or friends
Why inferred Descriptive 'may include' scope statement; typed as guidance.
Teams must assess means and capability to harm by gathering information on weapon access
BTAM teams will need to assess whether the individual has the means and capability to cause harm by gathering information about the weapons the individual has access to or could potentially obtain.
Lastly, BTAM teams will need to assess if the individual has the means and capability to cause harm by gathering information about the weapons the individual has access to or could potentially obtain.
Teams need to know whether people around the individual have been concerned about safety
BTAM teams will also need to understand whether people who know or have had contact with the individual have been concerned, especially if that concern relates to safety.
They will also need to understand if the people who know or have had contact with the individual have been concerned, especially if their concern is related to safety.
Each assessment theme should be understood in context of full background and history
Each assessment theme should be understood in the context of an individual's full background and behavioral history.
Each assessment theme should be understood in the context of an individual's full background and behavioral history.
BTAM teams must assess whether the individual poses risk of violence
As information is gathered, the BTAM team must assess whether an individual of concern poses a risk of violence.
As information is gathered from interviews, records, and other sources, the BTAM team must assess whether an individual of concern poses a risk of violence
Central question: does the individual pose a risk of violence at this time
The BTAM team's central question is whether the individual of concern poses a risk of violence at this time.
Does the individual of concern pose a risk of violence at this time?
Risk determination should weigh all information from the Systems Approach
The BTAM team should make this determination by considering all information obtained using the Systems Approach and relevant Assessment Themes and situational factors.
The BTAM team should make this determination by considering all information obtained using the Systems Approach and considering relevant Assessment Themes
If risk is found, the team should intervene and manage it (Step 6)
If the BTAM team determines that the individual poses a risk of harm, the team should take steps to intervene and manage the risk.
If the BTAM team determines that the individual of concern does pose a risk of harm, then the BTAM team should take steps to intervene and manage the risk posed
Risk classification levels should be clearly defined and articulable
If BTAM teams classify assessments into levels of risk (e.g., low, medium, and high), they should ensure that each classification level is clearly defined and articulable (e.g., clarifying the distinction between low and medium risk) to avoid confusion and inconsistencies across assessments.
BTAM teams should ensure that each classification level is clearly defined and articulable (e.g., clarifying the distinction between low and medium risk) to avoid confusion and inconsistencies across assessments
Protocols should let teams deviate from the ascribed risk level
BTAM protocols should allow the team to deviate from the ascribed level of risk when unique circumstances are identified during the assessment.
The BTAM team's protocols should allow for the team to deviate from the ascribed level of risk
Protocols should allow risk management resources even for low-risk cases
Protocols should also allow for implementing risk management resources in all cases, including those deemed low risk.
Protocols should also allow for implementing risk management resources in all cases, including those deemed low risk
Risk assessment is a dynamic and continuous process
Assessing risk is a dynamic and continuous process, so the team should routinely reassess changes or new information.
Assessing risk is a dynamic and continuous process
Routinely reassess changes that may raise, lower or contextualize risk
The BTAM team should routinely assess any changes or new information that may increase, decrease, or contextualize the risk of harm.
The BTAM team should routinely assess any changes or new information that may increase, decrease, or contextualize the risk of harm posed by the individual of concern
Risk management may be used even when no current risk of violence is found
Even when an individual does not appear to pose a current risk of violence, BTAM teams may implement risk management strategies to support the individual's well-being and prevent a potential escalation to violence.
BTAM teams may decide to implement risk management strategies to support the individual's well-being and prevent a potential escalation to violence
Organizations should develop standardized forms for the BTAM process
Organizations should develop standardized forms to give structure and consistency to documentation of the BTAM process.
Organizations should develop standardized forms to provide structure and consistency in documenting the BTAM process
Preliminary inquiry forms should record the report and determination of action
Preliminary inquiry forms should capture the nature of the report, sources reviewed, initial findings, and a determination of action.
Preliminary inquiry forms to capture the nature of the report, sources of information that must be reviewed, initial findings, and a determination of action
Interview questionnaires should collect background, behaviors and context
Interview questionnaires should gather background information about the interview subject, details of the behaviors of concern, and the context for those behaviors.
Interview questionnaires to gather background information about the interview subject
Assessment forms should document each source tapped during assessment
Assessment forms should document the sources tapped when gathering information, such as social media and employment records, plus final findings.
Assessment forms to document sources tapped when gathering information
Some teams may classify assessments as low, medium, or high risk for prioritization
Some BTAM teams might prefer to classify their assessments into levels of risk, such as low, medium, and high risk, for case prioritization and management.
Some BTAM teams might prefer to classify their assessments into levels of risk (e.g., low risk, medium risk, and high risk) for case prioritization and management.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
BTAM teams must act to reduce risk when an individual poses a risk of harm
When BTAM teams determine that an individual of concern poses a risk of harm to themselves or others, they must take appropriate action to reduce the risk of violence.
When BTAM teams determine that an individual of concern poses a risk of harm to themselves or others, they must take appropriate action to reduce the risk of violence.
BTAM teams should use a phased approach until case closure
BTAM teams should adopt a phased approach to continually assess risk and need, implement appropriate strategies, and monitor their impact until case closure is appropriate.
BTAM teams should adopt a phased approach to continually assess risk and need, identify and implement appropriate risk management strategies, and monitor the impact of these interventions until case closure is appropriate.
The risk management process has four central phases
The risk management process has four central phases: planning, implementation, evaluation, and case closure.
The risk management process has four central phases: planning, implementation, evaluation, and case closure.
Phases may run linearly or overlap, be revisited, or start early
Phases may occur in linear order, or some may occur concurrently, be revisited, or begin before a prior phase has ended.
the risk management process may be more dynamic whereby some phases occur concurrently, some phases are revisited, and/or some are initiated before a prior phase is ended
Why inferred Process description hedged with 'may'; classified as a guidance principle about how the model applies, not as conjecture.
Planning: the case management plan must be tailored and should set specific goals
During planning, the BTAM team develops a case management plan tailored to the individual, which should identify specific goals and strategies that account for concerning and mitigating factors.
This case management plan must be tailored to the individual and their unique circumstances and environment
Plans should set specific goals and account for assessment factors
The plan should identify specific goals and strategies to reduce risk and account for the concerning and mitigating factors identified during assessment.
should identify specific goals and strategies to reduce their risk of harm to themselves or others
The risk management process is dynamic and spans multiple phases
The report describes the risk management process as dynamic, spanning multiple phases.
The risk management process is dynamic, spanning multiple phases.
Risk management should be tailored to the individual of concern and their environment
The risk management process should be tailored to the unique characteristics of the individual of concern and their environment.
The process should be tailored to address the unique characteristics of the individual of concern and their environment.
BTAM teams should use assessment information to develop a risk management plan
Using information gathered during an assessment, BTAM teams should develop a plan to manage any risk posed by the individual of concern.
Using the information gathered during an assessment, BTAM teams should develop a plan to manage any risk posed by the individual of concern.
Case management plan should account for concerning and mitigating factors from assessment
The case management plan should account for the concerning and mitigating factors identified during assessment.
This plan should account for the concerning and mitigating factors identified during assessment.
Phases of Risk Management diagram: Plan, Implement, Evaluate cycle back to Plan
The Phases of Risk Management diagram shows a repeating cycle from Plan to Implement to Evaluate and back to Plan.
PHASES OF RISK MANAGEMENT
Why inferred figure description: only the heading is printed as text; the Plan, Implement, Evaluate cycle is read from the diagram
Diagram: off-ramp from Evaluate to Case Closure when appropriate
In the diagram, a dashed arrow labeled "off-ramp when appropriate" leads from the Evaluate phase to Case Closure.
OFF-RAMP WHEN APPROPRIATE
Why inferred figure description: the arrow label is printed in the diagram; its origin (Evaluate) and destination (Case Closure) are read from the diagram
Once established, the case management plan must be put into action
Once the case management plan is established, it must be put into action.
Once the case management plan has been established, it must be put into action.
Implementation examples: referrals, e-monitoring, PIP, prosocial interests
Strategies can include referrals for services and supports, monitoring electronic activity, placing an underperforming employee on a performance improvement plan, or encouraging prosocial interests.
Case management strategies vary but can include making referrals for services and supports, monitoring an individual's electronic activities
Evaluation: check whether strategies have the intended impact
During evaluation, the BTAM team should check in with the individual and/or relevant partners to determine whether strategies are having the intended impact.
the BTAM team should check in with the individual of concern and/or relevant partners to determine whether risk management strategies are having the intended impact
Evaluation should track compliance, engagement, and changes in behavior
The team should consider whether the individual is complying with interventions, engaging with programming, and showing changes in mood, mental state, or behavior.
The BTAM team should also consider whether the individual is complying with interventions, engaging with programming, and exhibiting any changes in mood, mental state, or behavior.
Revise the plan until the individual no longer poses a risk
If appropriate, the team should adjust the case management plan and implement revised strategies until the individual is no longer determined to pose a risk.
If appropriate, the BTAM team should adjust the case management plan and implement revised strategies until the individual is no longer determined to pose a risk of harm to themselves or others.
Closure decisions should involve all relevant stakeholders
The decision to close a case should involve all relevant stakeholders, including the BTAM team and organizational leaders.
The decision to close a case should involve all relevant stakeholders, including the BTAM team and organizational leaders.
Teams should document closure rationale and check in with stakeholders
BTAM teams should be able to articulate the rationale for closing a case, document the decision, and check in with relevant stakeholders, including the individual of concern as deemed appropriate, to ensure no concerns return and no new concerns arise.
BTAM teams should be able to articulate the rationale for closing a case, document the decision, and conduct a check-in with relevant stakeholders
Every phase should account for the elements of effective risk management
Throughout each phase of the risk management process, the BTAM team should account for relevant elements of effective risk management.
Throughout each of these phases of the risk management process, the BTAM team should account for relevant elements of effective risk management
Strategies should be informed by four foundational elements
Specific strategies should be informed by four elements: addressing factors of concern, redirecting motives, creating a less prone situation, and using the Systems Approach.
Specific risk management strategies used during the BTAM process should be informed by the four foundational elements
Identify and address objectively concerning behavioral and situational factors
BTAM teams should identify and address behavioral and situational factors that are objectively concerning, such as personal or workplace stressors.
BTAM teams should work to identify and address behavioral and situational factors that are objectively concerning, such as personal or workplace stressors.
Employee strategies: mentoring, reduced-rate counseling, bereavement, finance help
For employees, management can include employment support or mentoring, free or reduced-rate counseling, bereavement assistance, and financial consultation.
Management strategies for addressing factors of concern (i.e., negative factors) for employees can include additional employment support or mentoring, free or reduced-rate counseling services
BTAM teams can connect external individuals to services and courts
For external individuals such as customers or clients, BTAM teams can offer community service connections, liaise with law enforcement for wellness checks, and seek court orders when appropriate.
BTAM teams can offer connections to community and social service providers, liaise with law enforcement to conduct wellness checks, and partner with the judicial system to obtain court orders
Management should promote positive factors as well as address negatives
In addition to addressing negative factors, management should include efforts to promote the mitigating factors in the individual's life.
In addition to addressing negative factors, management should include efforts to promote positive factors
Positive factors: goal support, social connection, employee resources
Positive factors can include supporting personal, financial, and career goals, facilitating social connections, and participating in employee resources and interest groups.
These can include support of the individual's personal, financial, and/or career goals, facilitation of social connections, and participation in employee resources and interest groups.
BTAM teams should identify and redirect potential motives for violence
BTAM teams should identify potential motivations for violence and take active steps to remove, reduce, or redirect those motives toward prosocial behavior.
BTAM teams should work to identify potential motivations for violence and take active steps to remove, reduce, or redirect those motives
Figure 12 Address: identify negative factors and support positive outcomes
Address factors of concern and promote positive factors: identify negative factors and create strategies to support positive outcomes (examples: employment assistance, substance abuse treatment, counseling services).
Identify negative factors and create strategies to support positive outcomes.
Figure 12 Redirect: identify possible motivations and direct resources to them
Redirect potential motives for violence: identify possible motivations and direct resources to address them (examples: address workplace grievances, intervene to stop bullying, de-escalate interpersonal conflicts).
Identify possible motivations and direct resources to address them.
Figure 12 Create: build an environment in which violence is less likely
Create a situation less prone to violence: create an environment in which violence is less likely (examples: explore avenues for weapons removal, restrict access to work facilities, obtain restraining orders).
Create an environment in which violence is less likely.
Figure 12 Collaborate: work with community stakeholders who can contribute
Utilize the Systems Approach for management: collaborate with community stakeholders who can contribute (examples: leverage organizational resources, identify counseling services, engage family for support).
Collaborate with community stakeholders who can contribute.
Organizations must consider how to create a situation less prone to violence
Organizations must consider how to create a situation less prone to violence when developing risk management strategies.
Organizations must consider how to create a situation less prone to violence when developing risk management strategies.
Specific strategies depend on organization, resources, law, and situation
Specific strategies depend on the organization, its resources, applicable federal and state laws, and the characteristics of the situation and individual.
Specific strategies will depend on the organization, resources, applicable federal and state laws, and the characteristics of the situation and the individual of concern.
Examples: schedule changes, facility access limits, law enforcement, firearm limits
Examples include changing an employee's schedule when staff conflict, restricting an individual's facility access, engaging local law enforcement for support, and limiting access to firearms when permitted by law and consistent with constitutional protections.
Some strategies for creating a situation less prone to violence include changing an employee's schedule when there are conflicts among staff
ERPO (red flag) laws exist in over 20 states, D.C., and the U.S. Virgin Islands (as of 2026)
As of 2026, over 20 states, the District of Columbia, and the U.S. Virgin Islands have ERPO laws, also called red flag laws.
over 20 states, the District of Columbia, and the U.S. Virgin Islands have ERPO laws (also called "red flag" laws)
Eligible ERPO petitioners include law enforcement, family, partners, clinicians
Eligible petitioners for an ERPO may include law enforcement, family members, romantic partners, and clinicians, depending on state law.
Eligible petitioners for an ERPO may include law enforcement, family members, romantic partners, and clinicians.
ERPOs are modeled on domestic violence orders and focus on firearms
Modeled after domestic violence protection orders, ERPOs focus specifically on firearms access.
Modeled after domestic violence protection orders, ERPOs focus specifically on firearms access
California, Hawai'i, and U.S. Virgin Islands let employers petition for ERPOs
California, Hawai'i, and the U.S. Virgin Islands have adopted legislation allowing employers or coworkers to petition for an ERPO concerning an employee.
California, Hawai'i, and the U.S. Virgin Islands have adopted legislation to also allow employers or coworkers to petition for an ERPO concerning an employee.
The Systems Approach can identify resources to reduce risk
The Systems Approach can identify risk management resources that can be leveraged to reduce the risk of violence for an individual of concern.
The Systems Approach (see Step 5) can identify risk management resources that can be leveraged to reduce the risk of violence for an individual of concern.
Leveraging systems depends on affiliation, circumstances, and resources
When, how, and to what degree internal and external systems are leveraged depends on the individual's affiliation, circumstances, and the resources available.
When, how, and to what degree different internal and external systems are leveraged will depend on the individual of concern's affiliation with the organization, the unique circumstances of the individual of concern, and the resources available.
Organizations should proactively develop and regularly revise a resource guide
Organizations should proactively develop a resource guide for the BTAM team to use during management, and the team should regularly review and revise it.
Organizations should proactively develop a resource guide for the BTAM team to use during management.
Resource guide should list needs, strategy types, and resources
The resource guide should include common needs and risk factors, types of strategies to address them, and internal and external resources.
types of risk management strategies to address these needs
Why inferred Combines three bulleted items of the resource-guide list into one statement; the quote covers the middle item.
Strategies should be tailored and differ for employees and non-employees
Risk management strategies should be tailored to the organizational environment and the individual of concern, and can differ substantially by whether the individual is a current or former employee or a customer, client, patient, visitor, or otherwise unaffiliated with the workplace.
Risk management strategies should be tailored to address the unique characteristics of the organizational environment and the individual of concern
Organizations should develop standardized forms to document management plans
Organizations should develop standardized forms to document management plans and ensure structure and fidelity to the BTAM process.
Organizations should develop standardized forms to document management plans and ensure structure and fidelity to the BTAM process.
Case Management Plan form records interventions, timelines, monitor, outcomes
The case management plan form should record the interventions pursued, referral timelines, the person monitoring compliance, and the outcome of each intervention.
This form should document the specific interventions pursued and implemented, detailed timelines for providing referrals, the person designated to monitor response and compliance with interventions, and the outcome of each referral or intervention
Management plan should be adaptive and allow review of effectiveness
The management plan should be an adaptive, evolving process, and its forms should allow changes and review of how well strategies work.
This management plan should be an adaptive, evolving process, and the forms created to document management should allow for changes to the plan and opportunities to review the effectiveness of the management strategies implemented.
Case Completion Form should summarize the case and justify closure
The case completion form should document completion of the BTAM process, including a summary overview and an articulable reason for closure.
It should include a summary overview of the case and a reasonable and articulable determination for case closure.
BTAM teams can lead employees to positive outcomes by communicating expectations and consequences
BTAM teams can lead employees toward positive outcomes by clearly communicating workplace expectations and actions if they are not met, while listening to concerns and offering support.
BTAM teams can lead employees toward positive outcomes by clearly communicating workplace expectations and what actions will be taken if those expectations are not met
Monitoring and support are best practices for concerning employee behavior
Best practices for managing concerning employee behavior include monitoring and support and assistance.
Best practices in managing concerning behavior displayed by employees include
Support and assistance can address factors of concern
Support and assistance strategies can often be used to address factors of concern.
Support and assistance are strategies that can often be used to address factors of concern.
EAPs can be integral in offering a confidential avenue for support
EAPs can be integral in providing workplace support through a confidential avenue for personal, financial, legal, medical, or work-related issues.
EAPs can be integral in providing support for employees in the workplace by offering a confidential avenue to receive services for personal, financial, legal, medical, or work-related issues.
Case Completion Form should document completion of the BTAM process
The Case Completion Form should document the completion of the BTAM process.
This form should document the completion of the BTAM process.
Beyond EAPs, organizations can use mentors, peer support, and external resources
In addition to EAPs, organizations can identify workplace mentors and peer support personnel to foster connections and can leverage external resources.
In addition to EAPs, organizations can identify workplace mentors and peer support personnel to foster connections, as well as leverage external resources.
EAPs are often underutilized
EAPs provide counseling and support to employees with personal difficulties and are often underutilized.
EAPs provide counseling and support to employees experiencing personal difficulties and are often underutilized.
Organizations can offer EAPs during BTAM to connect employees with support
Organizations can offer EAPs as a resource during BTAM to connect employees in need with counseling and supportive services.
Organizations can offer EAPs as a resource during BTAM to connect employees in need with counseling and supportive services.
Use alternative dispute resolution as needed for a neutral third party
Mediators, an ombudsman, or other dispute resolution should be used as needed to provide a neutral third party skilled in resolving conflict.
The assistance of mediators, an ombudsman, or other forms of dispute resolution should be used as needed to provide a neutral third party skilled in resolving conflict.
PIPs can manage performance and offer structured support
Performance Improvement Plans can be a useful tool for managing an employee's performance, maintaining accountability, and offering structured support.
can be a useful tool for managing an employee's performance, maintaining accountability, and offering an avenue for structured support.
Organizations should practice safe separation strategies
When separating an employee is necessary, organizations should practice safe separation strategies to mitigate the risk of violence.
it is important that organizations practice safe separation strategies (see below) to mitigate the risk of violence.
Notify relevant personnel in advance of an employee separation
The decision to terminate an employee must be clearly communicated in advance to relevant parties such as security, IT, HR, management, and legal so access can be revoked, work reassigned, and the organization can ensure it is following state and federal guidelines regarding termination.
The decision to terminate an employee must be clearly communicated to relevant parties within the organization (e.g., security, IT, HR, management, legal) in advance
Set a calm, clear tone and avoid blaming or shaming the employee
Separation meetings should establish a calm and clear tone to the conversation and avoid blaming or shaming the employee.
Establish a calm and clear tone to the conversation and avoid blaming or shaming the employee.
A soft landing (severance, benefits, mental health) can reduce separation risk
Some organizations offer severance pay, a separation package, extended benefits or pensions, or mental health services, which can reduce work-related grievances or retaliation.
to reduce the risk of work-related grievances or retaliation.
Coordinate with community partners for services after separation
When appropriate and feasible, organizations should consider coordinating with community partners to offer services and support after separation.
When appropriate and feasible, consider coordinating with community partners to offer services and support for the employee following separation.
Create and follow offboarding protocols that restrict access and recover credentials
Offboarding protocols should restrict server, file, and facility access and ensure identification and credentials are returned.
These protocols should include ensuring that server, file, and facility access is restricted, and that identification and credentials are turned in when offboarding employees.
Offer mail or scheduled pickup for returning materials when appropriate
It may be appropriate or necessary to offer some employees options to return materials via mail or scheduled pickup.
It may be appropriate or necessary to offer options for some employees to return materials via mail or scheduled pickup.
Why inferred Conditional recommendation hedged with 'may'; classified as a statement (guidance), not conjecture.
Hold separation meetings in a safe, quiet location
Choose a safe and quiet location to conduct the meeting.
Choose a safe and quiet location to conduct the meeting.
There are times when separating an employee is necessary
The report acknowledges that separating an employee is sometimes necessary.
There are times when separating an employee is necessary.
Safe separation strategies apply to both terminations and voluntary resignations
Whether an employee is terminated or resigns voluntarily, organizations should consider the listed strategies to safely separate the employee.
Regardless of whether an employee is being terminated or has resigned voluntarily, organizations should consider the following strategies to safely separate an employee:
Ensure the appropriate personnel are present at a separation meeting
To create a calm environment, organizations should ensure the appropriate personnel for the separation are present.
Ensure the appropriate personnel for the separation are present.
Explain the termination rationale in a way that preserves the employee's dignity
Organizations should explain the rationale for a termination decision in a way that allows the employee to maintain their dignity.
Explain the rationale for the termination decision in a way that allows the employee to maintain their dignity.
Establish an offboarding checklist so no important separation actions are missed
Organizations should establish a list of necessary actions to take when separating employees so that no important actions are missed.
Establish a list of necessary actions to take when separating employees to ensure no important actions are missed.
EAPs can help employees reduce stress, improve coping, and handle difficulties
EAPs can help employees reduce stress, improve coping skills, and handle difficulties in their personal and professional lives.
EAPs can help employees reduce stress, improve coping skills, and handle difficulties they experience in their personal and professional lives.
Additional safety precautions may be appropriate for separations
In some cases it may be appropriate to use added safety precautions, such as an offsite or video meeting or a security or law enforcement presence.
In some cases, it may be appropriate to utilize additional safety precautions.
Why inferred Conditional recommendation hedged with 'may be appropriate'; classified as a statement.
Coordinated outreach may be used to intervene with former employees
When deemed necessary, coordinated outreach through appropriate channels may be used to evaluate, assess, and intervene with former employees to reduce the risk of violence.
When deemed necessary, coordinated outreach through appropriate channels may be used to evaluate, assess, and intervene with former employees to reduce the risk of violence.
Why inferred Conditional recommendation hedged with 'may be used'; classified as a statement.
Post-separation strategies: follow-up, online monitoring, re-evaluating supports
Post-separation strategies can include following up with an employee or their friends, family, or mental health provider; monitoring online behavior and communications (e.g., social media posts); and re-evaluating potential resources or support mechanisms to assist the employee in coping with stressors.
These strategies can include following up with an employee or their friends, family, or mental health provider; monitoring online behavior and communications (e.g., social media posts); and re-evaluating potential resources or support mechanisms to assist the employee in coping with stressors.
Post-separation strategies are not exhaustive or appropriate for every case
The post-separation strategies are not exhaustive and are not appropriate for all cases; BTAM teams should weigh them in the full context of the case.
These strategies are not exhaustive and not appropriate for all cases.
BTAM teams should weigh interventions against the full case context
BTAM teams should carefully consider these intervention methods in the full context of what is known about the individual and their environment.
BTAM teams should carefully consider these intervention methods in the full context of what is known about the individual and their environment.
Reviewing separation circumstances can reveal climate and interpersonal issues
It can also be helpful to review the circumstances of the separation to assess organizational climate and potential interpersonal issues.
It can also be helpful to review the circumstances of the separation to assess organizational climate and potential interpersonal issues.
Separations can exacerbate grievances and/or limit monitoring
Separations can create other problems, such as exacerbating existing grievances and/or limiting the organization's ability to monitor the employee's behavior.
Separations can create other problems, such as exacerbating existing grievances and/or limiting the organization's ability to monitor the employee's behavior.
Separation safety precautions: offsite or remote meetings, security or police presence
Additional safety precautions can include holding the separation meeting offsite or by phone or video, or having security or law enforcement present before, during, and after the termination.
These can include conducting a separation meeting at an offsite location or via a phone or video conference, or establishing a security or law enforcement presence before, during, and following the termination procedures.
High-risk former employees: stay-away orders and front-desk alerts to call security
For high-risk cases, other strategies might include working with law enforcement to issue a stay-away order and telling reception or front-desk staff to contact security or law enforcement if the individual is seen on premises after separation.
Other strategies, particularly for high-risk cases, might include coordinating with law enforcement to issue a “stay away” order from the premises and notifying reception, front desk, or other personnel to contact security or law enforcement if the individual of concern is observed on premises following the separation.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Zero-tolerance policies have at times proven overly punitive and inflexible
Zero-tolerance policies have been shown, at times, to be overly punitive and inflexible to the unique circumstances and needs of individuals of concern.
zero-tolerance policies have been shown, at times, to be overly punitive and inflexible to the unique circumstances and needs of individuals of concern
Employers should weigh automatic punitive responses case by case
On a case-by-case basis, employers should consider whether using automatic punitive responses for employees of concern is the best approach for safety.
On a case-by-case basis, employers should consider whether using automatic punitive responses for employees of concern is the best approach for safety.
BTAM teams should work with employers on a plan that may or may not be punitive
BTAM teams should work with the employer to develop and implement a case management plan to effectively address the factors of concern for the employee, which may or may not involve punitive measures.
BTAM teams should work with the employer to develop and implement a case management plan to effectively address the factors of concern for the employee, which may or may not involve punitive measures.
Inconsistent contact with non-employees may limit risk assessment
Inconsistent or indirect contact can make it difficult for the BTAM team to determine the extent of risk and may limit available strategies and resources.
The inconsistent or indirect contact between these individuals and the organization can make it difficult for the BTAM team to determine the extent of the risk
Contact law enforcement for immediate safety concerns
Organizations should contact law enforcement for immediate safety concerns.
Contact law enforcement for immediate safety concerns.
Issue written or verbal warnings stating concerns and expected behavior
Organizations should issue written or verbal warnings that state their concerns, behavioral expectations, and the actions that will follow if the behavior continues.
Issue written or verbal warnings to individuals to articulate the organization's concerns, expectations for the individual's behavior, and what actions the organization will take if the individual continues to engage in a concerning manner.
Established community partners can be an asset during the BTAM process
Community partners with whom the organization has established a relationship can be an asset during the BTAM process.
Community partners with whom the organization has established a relationship (see Step 1) can be an asset during the BTAM process.
Limit or restrict access to digital and physical spaces
Limiting or revoking access for problematic customers and visitors, such as restricting online accounts or issuing no-trespass or barring notices, can help create a situation less prone to violence.
Limiting or revoking access to digital and physical spaces for problematic customers and visitors (e.g., restricting online accounts, issuing "no trespass" orders or barring notices) can help create a situation less prone to violence.
Why inferred Directive recommendation; the 'can help' hedge is read as guidance rather than conjecture.
Alert employees, including building security, to watch for the individual
Organizations should issue alerts so employees and building security watch for the individual and know what actions to take if they see them.
Issue alerts for employees to be on the lookout for an individual of concern and inform employees, including building security personnel, of what actions to take if they see the individual.
Enhance physical security with personnel, cameras, and detection devices
Organizations can enhance physical security by stationing armed or unarmed security professionals or using cameras, metal detectors, or other security devices.
Enhance physical security measures. This can include stationing armed or unarmed security professionals at workplaces or using security cameras, metal detectors, or other security resources and devices.
Develop a strategy for continued monitoring of records and social media
Organizations should develop a strategy for continued monitoring, such as allocating staff to search public court records and monitor open-source online activity.
Develop a strategy for continued monitoring. This can include allocating staff to search public court records and monitor open-source online activity and social media accounts.
Organizations face unique challenges managing non-employees of concern
Organizations face unique challenges identifying, assessing, and managing individuals of concern not employed by them, including customers, clients, patients, visitors, and spouses or relatives of people connected to the workplace.
Organizations face unique challenges when trying to identify, assess, and manage individuals of concern that are not employed by the organization, including customers, clients, patients, visitors, and spouses or relatives of individuals connected to the workplace.
In non-imminent situations, decide whether law enforcement notification is appropriate
In non-imminent situations, organizations should determine whether notifying law enforcement is appropriate.
In non-imminent situations, determine if law enforcement notification is appropriate.
Community partners may provide services, resources, or support to individuals of concern
Organizations may leverage community partners so that individuals of concern may receive services, resources, or support.
Community partners may be leveraged by organizations so that individuals of concern may receive services, resources, or support.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Community partners may assist with property searches, monitoring, or criminal charges
Community partners may also assist with searches of an individual's property, monitoring their behavior, or filing criminal charges.
These community partners may also assist with searches of an individual’s property, monitoring their behavior, or filing criminal charges.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Healthcare settings are disproportionately affected by workplace violence
Healthcare settings are disproportionately impacted by workplace violence compared to other settings.
Healthcare settings are disproportionately impacted by workplace violence compared to other settings.
Workplace violence rates in healthcare have increased in recent years
Rates of workplace violence in healthcare settings have increased in recent years.
Rates of workplace violence in healthcare settings have also increased in recent years.
Most healthcare incidents are assaults by patients or visitors on ED staff
A majority of incidents in healthcare settings involve assaults by patients or visitors against nurses and emergency department staff.
A majority of incidents in healthcare settings involve assaults perpetrated by patients or visitors against nurses and staff of emergency departments.
Many general violence prevention strategies also apply in healthcare
Many violence prevention strategies in this publication can be useful for reducing risk of violence in healthcare settings.
While many of the violence prevention strategies described in this publication can be useful for reducing the risk of violence in healthcare settings
Healthcare organizations may adopt additional specific strategies for safety
Healthcare organizations may adopt other specific strategies to enhance the safety of patients, healthcare workers, and others.
healthcare organizations may also adopt other specific strategies to enhance the safety of patients, healthcare workers, and others
Use behavioral agreements with patients who have shown aggression
Behavioral agreements with patients who have shown aggression can outline appropriate conduct and the consequences of violating the agreement.
Using behavioral agreements with patients who have exhibited aggression to outline appropriate behavioral conduct and consequences for violating the agreement.
Regular de-escalation training and roleplay build staff skills
Regular training and roleplaying exercises build staff verbal and non-verbal de-escalation skills to prevent escalating aggression.
Providing regular training and roleplaying exercises to build staff skills in verbal and non-verbal de-escalation techniques to prevent escalating aggression.
Use trauma-informed care to help staff recognize patient trauma
A trauma-informed care approach helps staff recognize and respond to signs of trauma in patients.
Using a trauma-informed care approach to help staff recognize and respond to signs of trauma in patients.
Use EHR flags to alert staff to a patient's history of aggression
Electronic health record flags can alert staff when a patient has a history of aggression or violence.
Using electronic health record flags to alert staff when a patient has a history of aggression or violence.
A culture of safety, respect, trust, and support is crucial
A crucial component of workplace safety is developing an organizational culture of safety, respect, trust, and support.
A crucial component of workplace safety is developing an organizational culture of safety, respect, trust, and support.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
Positive climates can reduce grievances and enhance bystander reporting
Positive organizational climates can reduce the risk of grievances and enhance bystander reporting when concerns are identified.
Positive organizational climates can reduce the risk of grievances and enhance bystander reporting when concerns are identified.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
Cultivating a positive climate of safety helps employees feel valued
Cultivating a positive climate of safety and support is important to ensure employees feel valued.
Cultivating a positive climate of safety and support in an organization is important to ensure employees feel valued.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
Respected employees may view violence as less appropriate and hold fewer grievances
Employees who feel respected and supported are less likely to view violence as an appropriate means of addressing their issues and may hold fewer and/or less intense grievances against their colleagues (endnote 21).
Employees who feel respected and supported are less likely to view violence as an appropriate means of addressing their issues and may hold fewer and/or less intense grievances against their colleagues.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
Positive climates may also improve well-being, resilience, and productivity
Positive work climates can also have other important outcomes, including enhanced employee well-being, resilience, and productivity, as well as improved positive and supportive interactions with customers, clients, patients, and visitors (endnote 21).
Positive work climates can also have other important outcomes, including enhanced employee well-being, resilience, and productivity, as well as improved positive and supportive interactions with customers, clients, patients, and visitors.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
Step 7: promote a safe and supportive organizational climate
The seventh step of the guidance is to promote a safe and supportive organizational climate.
STEP 7: PROMOTE A SAFE AND SUPPORTIVE ORGANIZATIONAL CLIMATE
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
Organizational climate plays a vital role in preventing targeted workplace violence
The report states that organizational climate plays a vital role in preventing targeted workplace violence.
Organizational climate also plays a vital role in preventing targeted workplace violence.
cite page 86 Step 7: Promote a Safe and Supportive Organizational Climate
A variety of strategies can foster a safe and supportive environment
A variety of strategies can be instrumental to fostering a safe and supportive organizational environment.
A variety of strategies can be instrumental to fostering a safe and supportive organizational environment.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Safe hiring should measure an employee's aptitude and conduct
Organizations should practice safe hiring by measuring both an employee's aptitude and their conduct.
measuring both an employee's aptitude (i.e., their anticipated ability to do their assigned work effectively) and their conduct
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Organizations should follow federal, state, and local hiring laws
Organizations should follow all relevant federal, state, and local laws regarding hiring practices.
Organizations should be sure to follow all relevant federal, state, and local laws regarding hiring practices.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Supplement interviews with background, reference, or digital-footprint checks
Organizations may consider supplementing a standard interview with background checks, reference checks, or a review of an applicant's digital footprint.
organizations may consider supplementing a standard interview with background checks, reference checks, or a review of an applicant's digital footprint
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Hiring must promote safety while staying fair and lawful
Organizations must use caution to ensure hiring promotes workplace safety while following laws and treating all applicants with fairness, dignity, and respect.
Organizations must use caution to ensure that their hiring practices promote workplace safety while following federal, state, and local laws and simultaneously work to treat all applicants with fairness, dignity, and respect.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Organizations should intervene early when concerns are easily managed
It is important for organizations to be proactive and intervene early when concerns, such as minor disciplinary or performance issues, are easily managed.
It is important for organizations to be proactive and to intervene early when concerns are easily managed, such as with minor disciplinary or performance issues.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Discipline should be corrective, educating employees and showing how to get back on track
Disciplinary actions should not be used as punishment, but rather as corrective measures to educate employees about relevant issues with their performance and/or behavioral conduct and to inform them what actions are needed to get them back on the right track.
Disciplinary actions should not be used as punishment, but rather as corrective measures to educate employees about relevant issues with their performance and/or behavioral conduct and to inform them what actions are needed to get them back on the right track.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Establish clear conduct policies and respond proportionately to infractions
Organizations should establish clear policies on workplace conduct and respond appropriately and proportionately to infractions.
It is important to establish clear policies regarding workplace conduct and standards of behavior and to respond appropriately and proportionately to infractions.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Discipline may be appropriate for bullying, including termination
Disciplinary action may be appropriate for bullying in some instances, including reprimanding the aggressor, placing them on administrative leave, and/or terminating them from employment.
Disciplinary action may be appropriate in some instances, including reprimanding the aggressor, placing them on administrative leave, and/or terminating them from employment.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Mediation or transfer can also resolve bullying conflicts
Other strategies such as alternative dispute resolution, conflict mediation, or transferring an employee to a different work unit or facility can also be effective.
Other strategies can also be effective in handling these matters, including alternative dispute resolution methods, conflict mediation, and transferring one employee to a different
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Hiring decisions can be among the most impactful in shaping climate
Hiring decisions can be among the most impactful decisions made in an organizational setting, as the workforce cultivates their surrounding climate.
Hiring decisions can be among the most impactful decisions made in an organizational setting, as the workforce cultivates their surrounding climate.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Safe hiring should still avoid unfair hiring practices
While organizations are encouraged to carefully consider an applicant's prior behaviors to make safe hiring decisions, it is important to avoid unfair hiring practices.
it is important to avoid unfair hiring practices
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Strategy: use safe hiring practices
The first strategy listed for promoting a safe climate is to use safe hiring practices.
Use safe hiring practices.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Strategy: respond fairly and effectively to problems
Another strategy for promoting a safe climate is to respond fairly and effectively to problems.
Respond fairly and effectively to problems.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Fair, transparent, consistent discipline helps employees feel respected
Fairness, transparency, and consistency in the disciplinary process are important to help employees feel respected and to show the organization's commitment to a safe and positive work environment.
Fairness, transparency, and consistency in the disciplinary process are important to help employees feel respected and to demonstrate the organization’s commitment to a safe and positive work environment.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Strategy: address bullying and harassment at work
Another strategy for promoting a safe climate is to address bullying and harassment at work.
Address bullying and harassment at work.
cite page 87 Step 7: Promote a Safe and Supportive Organizational Climate
Climate assessments can reveal factors that let problematic behavior grow
It may also be helpful to conduct climate assessments to gauge the overall environment and identify factors that may have allowed problematic behaviors to flourish.
It may also be helpful to conduct climate assessments to gauge the overall organizational environment and identify factors that may have allowed these problematic behaviors to flourish.
Why inferred Recommendation hedged with 'may also be helpful'; classified as a statement.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Employees need to feel heard, understood, and supported
A key component of a positive organizational climate is ensuring employees feel heard, understood, and supported in the workplace.
A key component to a positive organizational climate is ensuring employees feel heard, understood, and supported in the workplace.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Offer employee resources such as EAPs, development, mental health support, and ERGs
Organizations can offer resources such as EAPs, professional development, mental health support, employee resource groups, and peer support programs.
This can be achieved through offering resources to aid employees in their personal and professional lives, including EAPs, professional development opportunities, mental health support, employee resource groups, and peer support programs.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Collaborate with broader community resources for a well-rounded menu
Organizations can collaborate with resources already available in their broader communities to develop a well-rounded menu of resources.
Organizations can also collaborate with resources already available in their broader communities to develop a well-rounded menu of resources and opportunities.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Positive work environments are cultivated through six practices, from goal-setting to inclusivity
These characteristics of positive work environments can be cultivated through practices such as discussing office goals and values, practicing compassion and respect, offering praise for strong performance, checking in on employee well-being, facilitating social connections, and pursuing inclusivity and collaboration.
These characteristics can be cultivated through practices, such as discussing office goals and values, practicing compassion and respect, offering praise for strong performance, checking in on employee well-being, facilitating social connections, and pursuing inclusivity and collaboration.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Foster a culture of safety where employees report without fear of reprisal
Organizations should foster a culture of safety in which employees are empowered to report concerns without fear of reprisal.
Employees should be empowered to report the concerns they have in the workplace without fear of reprisal.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
All employees should value identifying and managing concerns early
All employees should understand the value of identifying, assessing, and managing concerns early.
All employees should understand the value of identifying, assessing, and managing concerns early
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
The BTAM process is not intended to be punitive
Employees should recognize that the BTAM process is not intended to be punitive in nature.
all should recognize that the BTAM process is not intended to be punitive in nature.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Positive work environments show open communication, growth, respect, and recognition
There are numerous characteristics of positive work environments, including clear and open communication, opportunities for growth and creativity, healthy work relationships, accountability, professionalism, respect, and the recognition of employee contributions and performance.
There are numerous characteristics of positive work environments, including clear and open communication
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Strategy: invest in employee resources
Another strategy for promoting a safe climate is to invest in employee resources.
Invest in employee resources.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Strategy: facilitate positive interactions
Another strategy for promoting a safe climate is to facilitate positive interactions.
Facilitate positive interactions.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Strategy: cultivate a culture of safety
Another strategy for promoting a safe climate is to cultivate a culture of safety.
Cultivate a culture of safety.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
All employees should see safety as a priority and a community responsibility
It is important for all employees to recognize safety as a priority and a community responsibility.
It is important for all employees to recognize safety as a priority and a community responsibility.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Organizations should foster a culture of safety so employees know their role
Organizations should strive to foster a culture of safety so that all employees understand their role in keeping the workplace safe from violence.
Organizations should strive to foster a culture of safety in the workplace to ensure all employees understand their role in ensuring the workplace is safe from violence.
cite page 88 Step 7: Promote a Safe and Supportive Organizational Climate
Training is essential for BTAM success and workplace safety
Training is essential for ensuring BTAM program success and workplace safety.
Training is essential for ensuring BTAM program success and workplace safety.
Programs fall short if employees lack awareness, reporting knowledge, and trust
BTAM programs will not reach their full potential or will be underutilized if employees are not aware of the program, do not know what information to report or how to submit a report, and do not have trust in the process.
BTAM programs will not reach their full potential or will be underutilized if employees are not aware of the program, do not know what information to report or how to submit a report, and do not have trust in the process.
Organizations should invest in training for all employees
Organizations should invest in training that provides all employees with the knowledge and resources necessary for violence prevention.
Organizations should invest in training that provides all employees with the knowledge and resources necessary for violence prevention.
Training programs should weigh availability, content, frequency and messaging
Workforce training programs should consider training availability and accessibility, content, frequency, and continuous messaging.
Workforce training programs should consider training availability and accessibility, content, frequency, and continuous messaging.
All employees should receive training on violence prevention efforts
All employees should receive training on violence prevention efforts within their organization.
All employees should receive training on violence prevention efforts within their organization.
Training sessions must be accessible to employees
Training sessions must be accessible to employees to support program success.
Training sessions must be accessible to employees to support program success.
Organizations should choose the training medium for their workforce
Organizations should determine the appropriate medium for the training material, such as in-person facilitation, an online module, or a combination.
Organizations should determine the appropriate medium for the training material
Training modules should fit employees' knowledge, experience and time
Training modules should be sensitive to employees' knowledge, experience, and time available.
Training modules should be sensitive to the employees' knowledge, experience, and time available.
Consider module length, speaking languages and audio-visual needs
Organizations may wish to consider the time employees spend on training modules, variance in primary speaking languages, and the audio and visual needs of the workforce.
organizations may wish to consider the time employees typically spend on training modules, variance in primary speaking languages, and the audio and visual needs of the workforce
Step 8: provide training for all employees
The eighth step of the guidance is to provide training for all employees.
STEP 8: PROVIDE TRAINING FOR ALL EMPLOYEES
Weigh training access, content, frequency, and continuous messaging
Organizations should consider the availability and accessibility, content, and frequency of training, and how to use continuous messaging so employees are educated and empowered to contribute to violence prevention.
Organizations should consider the availability and accessibility, content, and frequency of training, and how to use continuous messaging to ensure employees are educated and empowered to contribute to violence prevention efforts.
Employee trust, buy-in, and reporting are critical to BTAM program success
Employee trust, buy-in, and reporting of concerns are critical elements for promoting BTAM program success.
Employee trust, buy-in, and reporting of concerns are critical elements for promoting BTAM program success.
BTAM training should sit within the wider workplace training curriculum
BTAM training for employees should be included within the larger workplace training curriculum.
BTAM training for employees should be included within the larger workplace training curriculum.
BTAM-specific content should be added to workplace violence training
Content specific to the BTAM process should be incorporated into workplace violence training.
Content specific to the BTAM process should be incorporated into workplace violence training to educate the general workforce about the process.
Content should cover what employees need to know and their responsibility
When determining content, it is important to consider what employees need to know about the BTAM process and their responsibility in violence prevention.
it is important to consider what employees need to know about the BTAM process and what their responsibility is in violence prevention.
Training content might include ten BTAM topics
Training content might include ten listed topics, from the BTAM definition to employee protections against retaliation for reporting.
Training content might include:
Training content might include the definition of BTAM
Training content might include the definition of behavioral threat assessment and management.
the definition of behavioral threat assessment and management
Training content might include BTAM guiding principles and goals
Training content might include the guiding principles and goals of BTAM programming.
the guiding principles and goals of BTAM programming
Training content might cover how BTAM fits the violence prevention strategy
Training content might include an overview of how BTAM fits within the larger workplace violence prevention strategy.
an overview of how BTAM fits within the larger workplace violence prevention strategy
Training content might reference relevant organizational BTAM policies
Training content might include reference to relevant organizational BTAM policies.
reference to relevant organizational BTAM policies
Training content might include an overview of the threat assessment process
Training content might include a general overview of the threat assessment and management process.
a general overview of the threat assessment and management process
Training content might explain the types of behaviors to report
Training content might include information on the types of behaviors to report.
information on the types of behaviors to report
Training content might explain how to report concerns
Training content might include how to report concerns.
how to report concerns
Training content might set expectations for what follows a report
Training content might include what to expect once a report has been submitted.
what to expect once a report has been submitted
Training content might set confidentiality expectations
Training content might include expectations about confidentiality.
expectations about confidentiality
Training content might describe employee protections against retaliation
Training content might include an overview of employee protections, including policies against retaliation for reporting.
an overview of employee protections, including policies against retaliation for reporting
All employees should be regularly trained on violence prevention
All employees should be regularly trained on workplace violence prevention.
All employees should be regularly trained on workplace violence prevention.
Deliver training at orientation and set refresher cycles
Organizations should deliver workplace violence prevention training during new employee orientation and establish cycles for refresher training.
Organizations should deliver workplace violence prevention training during new employee orientation and establish cycles for refresher training.
BTAM teams should set refresher frequency by size, turnover and resources
BTAM teams should determine refresher frequency based on organization size, turnover rate, and available resources, and fit it into the wider training schedule.
BTAM teams should determine the frequency of these refresher trainings based upon organization size, turnover rate, and available resources
Organizations should establish BTAM-specific general messaging
Organizations should establish general messaging efforts and initiatives specific to the BTAM process.
Organizations should establish general messaging efforts and initiatives specific to the BTAM process.
Messaging can include posters, safety reminders and support resources
Continuous messaging can include infographic posters on how to report concerning behaviors, regular workplace safety reminders, and information on available support resources.
infographic posters that educate employees on how to report concerning behaviors
Continuous messaging supports education between training cycles
Continuous messaging supports workplace violence prevention education between training cycles.
Continuous messaging supports workplace violence prevention education between training cycles.
Prevention is the best form of protection
The U.S. Secret Service has long held that prevention is the best form of protection.
The U.S. Secret Service has long held that prevention is the best form of protection.
Following the guidance steps lets organizations adopt BTAM principles
By following the steps in this operational guidance, organizations and their community safety partners can adopt the principles of the Secret Service model and move toward a structured approach to preventing targeted workplace violence.
By following the steps in this operational guidance, organizations and their community safety partners can adopt the pioneering principles
Guidance steps are scalable to organizations of varying sizes
The steps within this guide are intended to be scalable to organizations of varying sizes and resources.
the steps within this guide are intended to be scalable to organizations of varying sizes and resources
Many guidance steps depend on available organizational resources
NTAC recognizes that many of the steps in this guidance depend upon organizations and communities having important resources available to assist throughout the BTAM process.
many of the steps in this guidance depend upon organizations and communities having important resources available
Everyone has a role in keeping communities safe
Everyone has a role to play in keeping communities safe.
Everyone has a role to play in keeping communities safe, and the Secret Service stands ready to support our public safety partners in this vital mission.
The Secret Service stands ready to support public safety partners
The Secret Service stands ready to support its public safety partners in this vital mission.
the Secret Service stands ready to support our public safety partners in this vital mission.
The publication offers research and guidance to intervene before violence occurs
The publication offers both research and guidance intended to help organizations and their partners recognize concerning behaviors and intervene before violence can occur.
This publication offers both research and guidance intended to help organizations and their partners recognize concerning behaviors and intervene before violence can occur.
Data Table 1: incident data for all attacks and three subgroups
Data Table 1 (Incident Data) reports weapons, location types, motives, total casualties (injured and killed), and resolution for all attacks (n = 50) and for current or former employees (n = 22), customers, clients, patients, and visitors (n = 19), and romantic partners and relatives (n = 9). The column ns printed are 50 | 22 | 19 | 9.
APPENDICES: DATA TABLE 1
Data Table 2: attacker data for all attackers and three subgroups
Data Table 2 (Attacker Data) reports gender, age range, race/ethnicity, arrests/charges, history of domestic violence, mental health symptoms, stressors, concerning communications, elicited concern, bullying/harassment, inappropriate interest in violence or weapons, and behavior change for all attackers (n = 51) and for current or former employees (n = 22), customers, clients, patients, and visitors (n = 20), and romantic partners and relatives (n = 9). The column ns printed are 51 | 22 | 20 | 9.
ATTACKER DATA
Endnote 1: NTAC Mass Attacks in Public Spaces, 2016-2020
National Threat Assessment Center. (2023). Mass Attacks in Public Spaces: 2016 – 2020. U.S. Secret Service, Department of Homeland Security. www.secretservice.gov/ntac.
National Threat Assessment Center. (2023). Mass Attacks in Public Spaces: 2016 – 2020. U.S. Secret Service, Department of Homeland Security.
Endnote 2: SHRM on performance versus conduct issues
Society for Human Resources Management. (n.d.). “It’s critical to distinguish between performance and conduct issues.” www.shrm.org.
It’s critical to distinguish between performance and conduct issues.
Endnote 3: CISA Insider Threat Mitigation Guide (2020)
Cybersecurity and Infrastructure Security Agency. (2020). Insider Threat Mitigation Guide. Department of Homeland Security. www.cisa.gov.
3 Cybersecurity and Infrastructure Security Agency. (2020). Insider Threat Mitigation Guide.
Endnote 4: BLS fatal occupational injuries, 2023-2024
Bureau of Labor Statistics. (2026). “National census of fatal occupational injuries, 2023–2024.” Department of Labor. www.bls.gov.
National census of fatal occupational injuries, 2023–2024.
Endnote 5: BLS nonfatal days-away cases, 2023-2024
Bureau of Labor Statistics. (2026). “Nonfatal cases involving days away from work, 2023–2024.” Department of Labor. www.bls.gov.
Nonfatal cases involving days away from work, 2023–2024.
Endnote 6: DOL workplace violence program
Office of the Assistant Secretary for Administration & Management. (n.d.). "DOL workplace violence program." Department of Labor. www.dol.gov.
DOL workplace violence program.
Endnote 7: California DIR workplace violence prevention guidance
California Department of Industrial Relations. (2024, June). "Workplace violence prevention in general industry (non-health care settings) – Information for employers." Division of Occupational Safety & Health, State of California. www.dir.ca.gov.
Workplace violence prevention in general industry (non-health care settings) – Information for employers.
Endnote 8: CDC About intimate partner violence (2026)
Centers for Disease Control and Prevention. (2026, August 19). "About intimate partner violence." Department of Health and Human Services. www.cdc.gov.
About intimate partner violence.
Endnote 9: CDC Costs of Intimate Partner Violence (2003)
Centers for Disease Control and Prevention. (2003, March). Costs of Intimate Partner Violence Against Women in the United States. Department of Health and Human Services. www.cdc.gov.
Costs of Intimate Partner Violence Against Women in the United States.
Endnote 10: FBI Workplace Violence: Issues in Response
Federal Bureau of Investigation. (n.d.). Workplace Violence: Issues in Response. Department of Justice. www.fbi.gov.
Workplace Violence: Issues in Response.
Endnote 11: ASIS (2020) Workplace Violence and Active Assailant guidance
ASIS International. (2020). Workplace Violence and Active Assailant – Prevention, Intervention, and Response. www.asisonline.org.
Workplace Violence and Active Assailant – Prevention, Intervention, and Response.
Endnote 12: CISA and Secret Service K-12 bystander reporting toolkit
Cybersecurity and Infrastructure Security Agency & U.S. Secret Service. (2023). Improving School Safety Through Bystander Reporting: A Toolkit for Strengthening K–12 Reporting Programs. Department of Homeland Security. www.secretservice.gov/ntac.
Improving School Safety Through Bystander Reporting: A Toolkit for Strengthening K–12 Reporting Programs.
Endnote 13: CISA Insider Threat Mitigation Guide (repeat of 3)
Cybersecurity and Infrastructure Security Agency. (2020). Insider Threat Mitigation Guide. Department of Homeland Security. www.cisa.gov.
13 Cybersecurity and Infrastructure Security Agency. (2020). Insider Threat Mitigation Guide.
Endnote 14: Security Executive Council executive targeting report
Security Executive Council. (2025). Executive Targeting Report: Analysis of Attacks on Corporate Executives from 2003–2025. www.securityexecutivecouncil.com.
Executive Targeting Report: Analysis of Attacks on Corporate Executives from 2003–2025.
Endnote 15: Allied Universal World Security Report 2026
Allied Universal. (2026). World Security Report 2026. www.worldsecurityreport.com.
World Security Report 2026.
Endnote 16: ASIS executive threat environment benchmarking (2025)
ASIS International. (2025). The Executive Threat Environment: Benchmarking Research on Risk-Based Approaches to Executive Protection. www.asisonline.org.
The Executive Threat Environment: Benchmarking Research on Risk-Based Approaches to Executive Protection.
Endnote 17: NTAC Behavioral Threat Assessment Units guide (2024)
National Threat Assessment Center. (2024). Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence. U.S. Secret Service, Department of Homeland Security. www.secretservice.gov/ntac.
Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence.
Endnote 18: Attridge (2022) on small employers and EAPs during COVID-19
Attridge, M. (2022). Profile of small employers in the United States and the importance of employee assistance programs during the COVID-19 pandemic. American Journal of Health Promotion, 36(7). www.pmc.ncbi.nlm.nih.gov.
Profile of small employers in the United States and the importance of employee assistance programs during the COVID-19 pandemic.
Endnote 19: OSHA Healthcare: Workplace violence (2023)
Occupational Safety and Health Administration. (2023). "Healthcare: Workplace violence." Department of Labor. www.osha.gov.
Healthcare: Workplace violence.
Endnote 20: BLS nonfatal days-away cases, 2022
Bureau of Labor Statistics. (2023). "Nonfatal cases involving days away from work, 2022." Department of Labor. www.bls.gov.
Nonfatal cases involving days away from work, 2022.
Endnote 21: CISA Preventing workplace violence: Security best practices
Cybersecurity and Infrastructure Security Agency. (2023). "Preventing workplace violence: Security best practices." Department of Homeland Security. www.cisa.gov.
Preventing workplace violence: Security best practices.
Top
Find the Perfect Training Class For You