When employee behavior becomes concerning, what should a leader do?

A leader notices a change in an employee’s behavior.

An employee who was once engaged has become withdrawn. Someone who normally worked well with others is increasingly argumentative. A conflict that seemed manageable is becoming more personal. Another employee reports that a colleague's behavior is making people uncomfortable.

Nothing has clearly crossed the line into a threat.

There may be no policy violation.

No direct threat. No obvious indication of impending violence.

But the situation still feels different.

What should a leader do?

This is one of the most difficult moments in workplace violence prevention—not because the answer is necessarily complicated, but because leaders often feel pressure to make a definitive judgment before they have enough information.

The answer is not to ignore the concern.

It is also not to assume that concerning behavior means violence is coming.

The better approach is to recognize the behavioral change, gather relevant information, separate what is known from what is assumed, and determine what action is appropriate before the situation escalates.

A practical response has four parts: notice the change, separate facts from assumptions, gather the right information, and choose a proportionate next step. The sections below walk through each part without treating concerning behavior as proof of danger.

Concerning employee behavior rarely arrives with a clear label.

It may begin with a noticeable change from someone's baseline.

An employee may become increasingly angry, isolated, argumentative, fixated on a workplace dispute, emotionally volatile, or resistant to reasonable direction. There may be repeated conflicts with coworkers, escalating complaints, inappropriate communications, or behavior that causes others to become uneasy.

None of these behaviors, by themselves, establish that someone poses a threat.

They are signals that deserve attention.

The important question is not simply:

"Is this person dangerous?"

A better first question is:

"What has changed, and what do we know about it?"

That shift in thinking is important.

It moves the leader away from making a premature judgment and toward understanding the situation.

One of the most important distinctions leaders can make is between concerning behavior and threatening behavior.

An employee can be angry without being violent.

An employee can be struggling without posing a threat.

An employee can have a serious workplace conflict without intending to harm anyone.

At the same time, concerning behavior should not automatically be dismissed simply because no direct threat has been made.

Workplace violence prevention is not about predicting who will become violent; it is about identifying situations that deserve attention before they become harder to manage.

It is about recognizing circumstances that may require closer attention, determining whether risk is increasing, and taking reasonable action based on the information available.

That means leaders should avoid two common mistakes:

Minimizing the concern because nothing clearly actionable has happened.

And:

Overreacting because the behavior feels uncomfortable or unusual.

Neither approach produces good decision-making.

A single incident can be important, but context matters.

Leaders should consider whether the behavior represents an isolated event or part of a developing pattern.

Ask:

• Has there been a notable change from the employee's normal behavior?
• Has the behavior become more frequent or intense?
• Is the employee becoming increasingly focused on a particular grievance or conflict?
• Are workplace relationships deteriorating?
• Have coworkers or supervisors independently expressed concerns?
• Has the employee ignored previous interventions or boundaries?
• Are there new behaviors that raise questions about safety, judgment, or impulse control?
• Is there evidence that the situation is escalating?

The goal is not to create a checklist that predicts violence.

The goal is to understand the trajectory: whether the behavior is stable, improving, deteriorating, or becoming more difficult to manage.

A behavior that is concerning today may become more significant if it is increasing in frequency, intensity, or impact.

This is where leadership judgment becomes especially important.

When people are concerned about an employee, assumptions can quickly become mixed with facts.

For example:

Fact: An employee sent several angry emails about a workplace dispute.

Assumption: The employee is becoming dangerous.

Fact: The employee has repeatedly argued with a supervisor.

Assumption: The employee is going to retaliate.

Fact: Coworkers report feeling uncomfortable around the employee.

Assumption: The employee intends to hurt someone.

Those assumptions may eventually prove relevant—or they may not.

But treating them as established facts can distort the assessment.

Leaders should ask:

What do we know?

What do we think we know?

What still needs to be understood?

That distinction creates better decisions.

When behavior becomes concerning, the next step should be to gather appropriate information.

That may involve speaking with supervisors, HR, employees who observed the behavior, security personnel, or other individuals with relevant information.

Depending on the circumstances, an organization may also need to review:

• relevant workplace policies
• previous incidents
• documented conflicts
• communications
• performance or disciplinary history
• prior interventions
• reported changes in behavior
• information suggesting escalation

The purpose is not to build a case against an employee.

It is to understand the situation well enough to determine what should happen next.

That distinction matters because information gathering should support decision-making—not confirmation of a conclusion that has already been reached.

Behavioral risk is dynamic.

The situation should not be assessed once and then forgotten.

A leader should consider whether circumstances are: stable, improving, deteriorating, or unclear.

Escalation may involve changes in frequency, intensity, specificity, fixation, conflict, or the employee's response to intervention.

Added information, a change in circumstances, or a failed intervention can also change the risk picture.

This is why workplace violence prevention cannot be reduced by identifying a list of warning signs.

The same behavior can mean very different things depending on context.

The more useful question is:

"What is happening now, and where does this appear to be going?"

Eventually, a leader must make a decision.

Sometimes the appropriate response may be a management conversation.

Sometimes HR involvement is appropriate.

Sometimes additional information needs to be gathered.

Sometimes workplace accommodations, conflict resolution, or employee-support resources may be relevant.

In other circumstances, the concern may warrant a formal behavioral threat assessment or threat-management process.

And when there is an immediate safety concern, the organization may need to take more urgent protective action and involve appropriate emergency or law-enforcement resources.

There is no universal response to concerning employee behavior.

The appropriate action depends on the facts, circumstances, organizational policies, applicable law, and level of risk.

The objective is not to choose the most dramatic response.

It is to choose the right response for the information available.

One of the most overlooked elements of behavioral risk management is documenting why a decision was made.

A record should not simply say:

"Employee made concerning comments.”

A more useful record captures what was reported, what information was reviewed, what uncertainties remained, what actions were considered, what action was taken, and why.

This creates an important organizational record.

It also allows the organization to reassess the situation later.

If new information emerges, leaders can ask:

• What did we know at the time?
• What did we do with that information?
• What has changed since then?

That is the foundation of defensible decision-making.

One of the biggest mistakes leaders can make is believing they must wait until behavior becomes clearly threatening before taking it seriously.

They do not.

Early intervention does not mean assuming the worst.

It means recognizing that earlier conversations create more options.

A leader who addresses a developing conflict early may have many interventions available.

A leader who waits until the situation becomes a crisis may have far fewer.

That is why early warning signs matter.

Not because they allow us to predict violence with certainty.

They do not.

They matter because they may provide an opportunity to understand what is happening and intervene before the situation becomes more difficult to manage.

When employee behavior becomes concerning, the central leadership question is not:

"Can I prove this person is dangerous?"

The better question is:

"Do we have enough information to decide what needs to happen next?"

That is the leadership decision point.

It requires leaders to balance vigilance with fairness, action with restraint, and concern with evidence.

Good workplace violence prevention is not about reacting to every unusual behavior.

It is about recognizing when something has changed, taking concerns seriously, gathering appropriate information, assessing the situation, and making a reasoned decision about what to do next.

Because the goal is not simply to respond to violence.

The goal is to recognize behavioral risk early enough that leaders still have options.

Clarity Before Crisis™

The earlier the conversation, the more options leaders have.

 

At Risk Mitigation Technologies LLC, we help organizations recognize behavioral risk, assess concerning situations, and make clear, defensible decisions before those situations escalate into disruption, liability, or workplace violence.

The objective is not to predict who will become violent.

It is to help leaders understand what is happening, what it may mean, and what to do next.