Short answer: A threat assessment process for organizations has seven working parts: a written policy, a multidisciplinary team, easy ways to report concerns, fast triage, a structured assessment, active case management, and documentation with regular review. It evaluates behavior rather than profiles, scales from a five-person nonprofit to a multi-site employer, and works best when it exists before the first worrying report arrives.
Almost every organization has a fire evacuation plan. Most have an emergency contact list. Far fewer have a defined answer to this question: what happens when someone reports that a person is worrying them?
Without an answer, the response depends on who hears about it, how busy they are, and whether they happen to trust their instincts that day. That is not a process. It is luck.
I’ve spent my career on both sides of this problem, in league security and in state law enforcement leadership. The organizations that handle concerning situations well don’t have better instincts. They have a process everyone knows.
Why a Process Beats a Hero
Every organization has one person who “just knows” how to handle difficult situations. That person gets promoted, gets sick, or leaves. A process outlasts them.
Research from the U.S. Secret Service’s National Threat Assessment Center points to a consistent pattern: targeted violence is usually the end of a visible path, not a bolt from the blue, and the way to interrupt that path is a structured, repeatable approach that looks at behavior. The guidance is built to scale to organizations of different sizes and resources.
The Seven Parts of a Working Process
1. A written policy. One or two pages stating the purpose, who is covered, what kinds of concerns trigger review, and that the process looks at behavior, not identity. It should also say plainly that good-faith reports are protected and that retaliation is prohibited.
2. A multidisciplinary team. No single department sees the whole picture. Most teams include HR, legal counsel, security, a senior leader with authority to act, and access to mental health expertise. A law enforcement liaison is valuable for criminal conduct. Smaller organizations can pair two or three internal people with an outside advisor.
3. Easy, trusted reporting. If reporting is awkward, people won’t do it. Offer more than one route: a manager, HR, a hotline or email, and a way to report without fear. Tell people what to report: threats, fixations, escalating grievances, weapons talk, and sharp behavior changes.
4. Fast triage. Every report gets a quick first look. The first question is whether there is immediate danger. If yes, call 911. If not, the case moves to structured review.
5. A structured assessment. The team gathers facts from several sources and works through consistent questions: What was said or done? Is there a target? Is the behavior escalating? What is driving it? Is there evidence of planning or access to means? What stabilizing factors remain? We cover the step-by-step method in our guide on how to assess an employee of concern.
6. Case management. The assessment ends in a plan, not a verdict. Responses range from a supportive conversation and an assistance referral, to clear behavioral expectations, access or schedule changes, added security measures, and law enforcement coordination. Then someone owns the follow-up.
7. Documentation and review. Record what was reported, what was decided, and why. Review closed cases periodically to find patterns and fix gaps. Train the team and refresh awareness for staff at least yearly.
For the program-level view of how these pieces fit together, see our overview of behavioral threat assessment in the workplace.
How the Process Flows
Report received → same-day triage → information gathering → team assessment → management plan → monitoring and reassessment → documented closure and review.
Notice that “closure” is the last step, and only when the team agrees the concern has genuinely subsided.
Scaling It to Your Size
- Small organizations (under 50 people): A three-person group, such as an owner or executive director, an HR lead, and an outside advisor, can run a sound process. Keep the policy short and the reporting routes obvious.
- Mid-size organizations: Formalize the team, assign a case coordinator, and add a standing review meeting.
- Large or multi-site organizations: Use a central team with trained local points of contact, and make sure every site follows the same standards.
Where Organizations Go Wrong
- No one owns it. If everyone is responsible, no one is.
- The process lives only in HR. HR is essential, but security, legal, and leadership all hold pieces.
- No training. A policy nobody has practiced fails the first time it matters.
- Reports disappear. People stop reporting when nothing visibly happens. Close the loop with the reporter wherever you can.
- It ends at termination. Separation changes the risk, but it doesn’t remove it.
- No documentation. Unrecorded decisions can’t be defended or learned from.
What This Means in Orange County
Orange County’s organizations are varied, and each type has its own exposure:
- Hospitality and tourism employers with large, public-facing, seasonal workforces
- Healthcare systems and clinics with high-stress environments and visitors
- Universities and school districts with students, staff, and open campuses
- Technology, medical device, and professional services firms clustered in busy office corridors
- Faith communities and nonprofits, which are often open to the public and thinly staffed
- Multi-site organizations where one location may have a strong process and another has none
If you’re thinking about how risk looks across your whole operation, our look at risk management consulting in Orange County is a good companion read.
California Compliance
Most California employers must maintain a written workplace violence prevention plan, an incident log, and employee training under SB 553. Cal/OSHA provides guidance and a model plan. A threat assessment process is what makes that plan operational: it tells people what happens after a concern is reported. Because employment, disability, and privacy laws also apply, involve legal counsel when you design it. This article is general information, not legal advice.
Frequently Asked Questions
What is a threat assessment process? A defined set of steps for receiving reports of concerning behavior, evaluating whether someone may be moving toward violence, and managing the situation.
Who should be on the team? Typically HR, legal, security, a decision-making leader, and access to mental health expertise, with law enforcement as needed.
Does every organization need one? Any organization with employees, members, students, or the public on site benefits, regardless of size.
How often should we review it? At least once a year, and after any significant incident or organizational change.
Is this the same as an incident response plan? No. Incident response covers what to do during an emergency. Threat assessment aims to prevent one.
The Bottom Line
You can’t control whether a worrying situation arises. You can control whether your organization is ready for it. A clear, tested process turns a vague unease into a fair, documented, effective response.
For more information on building a threat assessment process for your Orange County organization, book an appointment with Jeffrey Miller Consulting, or learn how a Risk & Vulnerability Assessment fits into your overall plan.