Short answer: To assess an employee of concern, first confirm there is no immediate danger (if there is, call 911). Then document observable behavior, gather information from several sources, and ask structured questions: What was said or done? Is there a target? Is the behavior escalating? Does the person have a grievance, a plan, or access to means? Rate the level of concern, build a management plan, and reassess. Assess behavior, never a stereotype, and involve HR, legal, and security together.
A manager walks into HR and says, “I’m probably overreacting, but…”
That sentence is how most serious situations first come to light. The employee hasn’t threatened anyone outright. Something has just changed: the tone, the attendance, the way they talk about a supervisor, a comment that landed wrong. Nobody knows whether this is a bad month or the start of something worse.
This guide walks through how to find out, calmly and fairly, before you have to guess.
First, the Only Rule That Overrides Everything
If someone is in immediate danger, or a person has a weapon or has made a specific, imminent threat, call 911. Everything below is for situations that are worrying but not yet an emergency.
What “Employee of Concern” Really Means
It is not a diagnosis, and it is not an accusation. It is a working label for a person whose behavior has made others uncomfortable enough that someone should take a structured look.
Most employees of concern are struggling, not dangerous. The point of an assessment is to tell the difference, and to help the person when help is the right answer.
Research from the U.S. Secret Service’s National Threat Assessment Center has long shown that targeted violence is usually a process, not a sudden event, and that it is often preceded by behavior others could see. That is the opening you are looking for. It is also why guessing from a profile fails: there is no reliable type. You assess what the person does.
The Step-by-Step Assessment
1. Secure the situation. Make sure nobody is at immediate risk. If the person is on site and agitated, don’t confront them alone or in private. Involve security or a second manager.
2. Write down facts, not conclusions. “He said, ‘People like her should pay,’ in the break room on Tuesday” is useful. “He seems unstable” is not. Record who, what, when, and where, using exact words where possible.
3. Gather information from more than one source. Talk to the supervisor and to coworkers who have seen the behavior firsthand. Review attendance, performance, discipline, and prior complaints. One person’s account is never the full picture, and a rumor is not evidence.
4. Ask the right questions. Work through these as a team:
- What exactly was said or done, and how specific was it?
- Is there an identifiable target, such as a coworker, manager, or former colleague?
- Is the behavior escalating in frequency or intensity?
- What is driving it: a grievance, a loss, a conflict, a pending termination?
- Has the person talked about a plan, or shown interest in weapons or past attacks that is unusual for them?
- Do they have access to the target, the building, or means of harm?
- What has changed recently, and what stabilizing factors remain, such as family, friends, or treatment?
5. Rate the level of concern. Most teams sort cases into low, moderate, or high concern. Low might mean a supportive check-in and a note in the file. Moderate calls for active management and monitoring. High means immediate protective steps and law enforcement involvement.
6. Build a management plan. Match the response to the person. That can include a supportive conversation, an employee assistance referral, a clear statement of behavioral expectations, schedule or access changes, added security awareness, and coordination with law enforcement when warranted.
7. Follow up and reassess. Situations change. A calm week doesn’t close a case. Set a date to check in again, and document what you find.
If you want the full team structure behind this process, our overview of behavioral threat assessment in the workplace explains who should be at the table and how cases move from report to resolution.
Mistakes That Make Things Worse
- Playing amateur psychologist. You are not diagnosing anyone. Describe behavior and let qualified professionals interpret it.
- Handling it alone. One manager’s judgment, however good, is a single point of failure.
- Waiting for a direct threat. By then, your options are narrower and the stakes are higher.
- Skipping the plan before a termination. A firing is one of the highest-risk moments in any case. Plan the logistics, the access cutoff, and the support offered before the meeting, not after.
- Promising total confidentiality. You may need to share information with HR, legal, security, or law enforcement. Don’t promise what you can’t deliver.
- Letting the file go cold. Many cases involve someone who stays in the community after leaving the job. Ending employment does not end the risk.
What Makes Los Angeles Different
Los Angeles employers face a mix that shapes how concerns surface:
- Entertainment and media production, where crews are large, temporary, and spread across locations, so a worrying person may not be on any single manager’s radar.
- High-rise and multi-tenant offices in Downtown, Century City, and the Westside, where access control is shared and a person who has left your company can still reach the building.
- Healthcare, logistics, and port-adjacent operations, with shift work, high stress, and public-facing roles.
- Contractors, freelancers, and hybrid staff, where concerning behavior may show up in messages, on video calls, or online instead of in the hallway.
If your facility’s physical layout is part of the picture, a security risk and vulnerability assessment in Los Angeles looks at the building and surroundings alongside the people side.
California Rules to Keep in Mind
Since July 2024, nearly every California employer has needed a written workplace violence prevention plan, an incident log, and training under SB 553. Cal/OSHA publishes guidance and a model plan for general industry. Your assessment process should line up with that plan, not sit apart from it.
Employment, disability, and privacy laws also affect what you can ask and how you act. Bring in counsel early. This guide is general information, not legal advice.
Frequently Asked Questions
What is an employee of concern? An employee whose behavior has worried others enough to warrant a structured review. It does not mean the person is dangerous or has done anything wrong.
Should I confront the employee directly? Not alone, and not before you have facts and a plan. Involve HR and security first, especially if the person seems agitated.
What should I document? Specific, observable behavior: exact words, dates, locations, witnesses, and any change from the person’s normal conduct. Leave out guesses and labels.
When should I call law enforcement? Immediately if there is a weapon, an imminent threat, or a danger to anyone. Otherwise, bring them in when your assessment shows a credible risk of violence.
Can a small business do this? Yes. A small group, such as an owner, an HR lead, and an outside advisor, can run a sound process.
The Bottom Line
Most employees of concern need attention, not alarm. A fair, documented, behavior-based assessment protects the person, your team, and your company, and it replaces guesswork with a plan. If you’re not sure your organization is ready, our guide on when to hire a security consultant covers the clear triggers.
For more information on assessing a specific situation or building a process before you need one, book an appointment with Jeffrey Miller Consulting, or learn about our Risk & Vulnerability Assessment services.