What Should an Employer Do When an Employee’s Behavior Raises Concern?

What should an employer do when an employee’s behavior raises concern?

The first step is not to determine whether the employee is dangerous.

It is to slow down, separate observable facts from assumptions, understand what has changed, gather relevant information, and determine what decision needs to be made.

A concerning employee interaction, angry statement, unusual behavior, policy violation, workplace conflict, or escalating grievance does not automatically indicate a threat.

At the same time, dismissing concerning behavior because no direct threat has been made can leave an organization with fewer options if the situation continues to escalate.

The goal is not to predict violence. The goal is to recognize meaningful behavioral risk early enough to make a clear, informed, and defensible decision.

When employee behavior raises concern, an employer should begin with the facts.

Before labeling the employee, interpreting motives, or deciding what the behavior means, determine:

• What actually happened?
• Who observed or reported it?
• When did it occur?
• What was said or done?
• What happened immediately before the behavior?
• Has similar behavior occurred previously?
• Has the behavior changed or escalated?
• What information is still missing?
• What decision needs to be made now?

This approach creates an important distinction between recognizing a concern and concluding that someone represents a threat.

Those are not the same thing.

Step 1: Take the Concern Seriously Without Assuming the Worst

A common mistake is to move too quickly in either direction.

One response is:

“That's just how this employee behaves.”

The other is:

“This person is dangerous.”

Neither conclusion may be supported by the available information.

A better starting point is:

“Something about this behavior concerns us. Let's understand what happened.”

Taking a concern seriously does not require assuming that violence will occur.

It means giving leadership an opportunity to gather information before the situation becomes more difficult to manage.

Step 2: Separate Facts From Interpretations

This is one of the most important steps in any behavioral-risk assessment.

Consider the difference between:

Fact: An employee told a supervisor, “You will regret what you did to me,” after receiving a disciplinary action.

Interpretation: The employee threatened to kill the supervisor.

The second statement may ultimately prove relevant—but it is an interpretation of the first.

A responsible assessment starts by documenting what was actually said or observed.

Whenever possible, preserve:

• Exact statements
• Emails and messages
• Dates and times
• Witness accounts
• Relevant employment actions
• Previous incidents
• Changes in behavior
• Relevant access or security information

The objective is to establish a reliable factual foundation before drawing conclusions.

Step 3: Determine What Has Changed

Behavioral change deserves attention.

Ask:

What was the employee's behavior like before this incident?

What is different now?

A change may involve:

• Increasing anger
• More frequent confrontations
• Escalating communications
• Repeated complaints or grievances
• Fixation on a particular person or issue
• Boundary violations
• Unwanted contact
• Retaliatory behavior
• Attempts to gain access
• Increasingly direct or concerning statements

No single behavior establishes that someone will become violent.

The value comes from examining the pattern, context, and progression of behavior.

The U.S. Secret Service National Threat Assessment Center emphasizes this broader approach: behavioral threat assessment involves identifying concerning behavior, gathering information, assessing risk, and developing appropriate interventions rather than relying on a single warning sign.

Step 4: Understand the Context

Behavior does not occur in isolation.

A workplace incident may follow:

• A disciplinary action
• Termination or threatened termination
• A significant workplace conflict
• A perceived injustice
• A relationship conflict
• A major organizational change
• A workplace investigation
• A denied request or grievance
• Another significant event

The existence of a stressor does not establish that someone will become violent.

But understanding the circumstances surrounding behavior can help leaders determine what information matters and what questions need to be asked.

The objective is context, not diagnosis.

Step 5: Ask What You Don't Know

This is where many organizations can improve their decision-making.

When a concern arises, leaders naturally focus on the information they have.

They should also identify the information they don't have.

For example:

• Has anyone else experienced similar behavior?
• Are there additional communications?
• Has the behavior occurred outside the immediate workplace?
• Has the individual made similar statements to others?
• Has there been an escalation in frequency or intensity?
• Are there concerns about access to a particular person or location?
• Are there protective factors or circumstances that may reduce concern?
• Has anyone independently verified the reported information?

Uncertainty does not automatically mean high risk.

But significant uncertainty can mean that more information is needed before making an important decision.

Step 6: Determine Whether This Is a Management Issue, a Safety Issue, or Both

Not every concerning employee behavior requires a formal threat assessment.

Some situations may be appropriately addressed through ordinary management or HR processes.

Others may require additional security or behavioral-risk expertise.

And some may involve both.

For example, an employee may violate a workplace policy while also displaying behavior that raises safety concerns.

In that situation, the organization may need to manage the employment issue while separately evaluating the behavioral concern.

Keeping those questions distinct can help prevent an organization from allowing an employment decision to substitute for a safety assessment—or vice versa.

Step 7: Decide Who Needs to Be Involved

The appropriate response depends on the circumstances.

Depending on the concern, relevant participants may include:

• HR
• Senior leadership
• Security
• Legal counsel
• Employee relations
• Occupational health or behavioral-health professionals
• Law enforcement
• An external threat-assessment professional

Not every situation requires all of these participants.

The important question is:

Who has the information, authority, or expertise necessary to make this decision responsibly?

A multidisciplinary approach can be particularly valuable when the facts are complicated or different departments have different pieces of the story.

Step 8: Consider Whether a Formal Threat Assessment Is Warranted

A structured behavioral threat assessment may be appropriate when:

• Behavior is escalating
• There is a pattern of concerning conduct
• There are credible threats or communications
• The individual appears increasingly fixated on a person, organization, or grievance
• There are repeated boundary violations
• There are concerns about stalking or targeted behavior
• There are attempts to obtain access to a person or location
• The organization cannot adequately evaluate the concern through ordinary management processes
• Leadership needs an independent assessment before making a significant decision

A formal assessment does not mean the organization has concluded that the employee is dangerous.

It means the organization recognizes that the concern deserves a more structured evaluation.

Step 9: Document the Concern and the Decision

Documentation is not merely an administrative task.

It helps establish what the organization knew, what it did not know, what information was considered, and why particular decisions were made.

Documentation should distinguish:

Observed behavior

from

reported information

from

interpretation

from

decision.

For example:

“Supervisor reported that employee stated X during meeting on September 12.”

is different from:

“Employee became threatening.”

The first documents information.

The second provides an interpretation.

That distinction becomes particularly important when employment, legal, or safety decisions are involved.

Step 10: Take Proportionate Action

Once the available information has been evaluated, leadership must decide what action is appropriate.

Depending on the circumstances, that might include:

• Continuing routine management
• Additional fact-finding
• Establishing workplace boundaries
• Employee-relations intervention
• Changes to access
• Security measures
• Safety planning
• Consultation with legal counsel
• Formal threat assessment
• Law enforcement involvement
• Continued monitoring and reassessment

There is no universal response.

The appropriate action should be based on the available information and the circumstances of the particular situation.

Step 11: Reassess as New Information Develops

Behavioral risk is not necessarily static.

A situation that appears manageable today may require additional attention tomorrow if circumstances change.

Likewise, new information may reduce concern.

That means an effective process should include reassessment.

Ask:

What has changed?

What new information do we have?

Has the behavior escalated, stabilized, or stopped?

Does our previous decision still make sense?

This is why threat assessment should be viewed as a process rather than a one-time determination.

Organizations sometimes believe they need to know exactly what will happen before they can act.

They don't.

Leadership decisions are often made under uncertainty.

The challenge is determining whether there is enough reliable information to make a reasonable decision—or whether additional assessment is necessary.

That moment is what I call the Leadership Decision Point™.

It is where recognition becomes decision-making.

The questions are straightforward:

What do we know?

What don't we know?

What decisions need to be made now?

Those questions help move an organization away from speculation and toward deliberate action.

The process can be organized into five practical steps:

Recognize

Identify the behavior or circumstances that caused concern.

Analyze

Examine the available facts, context, patterns, and relevant information.

Challenge

Test assumptions and identify information that may be missing or misunderstood.

Decide

Determine what level of intervention, assessment, monitoring, or protective action is appropriate.

Act

Implement the decision, document the rationale, and reassess as circumstances change.

This sequence forms the foundation of the P.R.E.V.A.I.L.™ Leadership System developed by Risk Mitigation Technologies.

The principle is simple:

Recognition informs decisions. Decisions drive action. Action creates prevention.

Don't Ignore the Concern Because There Was No Direct Threat

A direct threat is not necessarily required before concerning behavior deserves attention.

Don't Assume That Concerning Behavior Equals Violence

Behavior must be evaluated in context.

Don't Diagnose the Employee

Employers should focus on observable behavior, relevant circumstances, and reliable information.

Don't Rely on a Single Warning Sign

Patterns and context are generally more informative than isolated behaviors.

Don't Let Fear Make the Decision

Concern should lead to assessment—not automatic conclusions.

Don't Let the Desire to Avoid Conflict Prevent Appropriate Action

Avoiding a difficult conversation today can sometimes leave leadership with fewer options later.

Don't Assume That One Decision Ends the Process

Circumstances change.

Reassessment matters.

An employer should consider outside behavioral-risk or threat-assessment assistance when the organization lacks the expertise to evaluate a complex concern, when the situation is escalating, when there are significant disagreements about risk, or when leadership needs an independent assessment to support an important decision.

Outside assistance may also be appropriate when the situation involves:

• Potential targeted violence
• Stalking or persistent unwanted contact
• Escalating grievance
• Significant threats or threatening communications
• Access concerns
• Retaliation concerns
• A high-risk employment decision
• A complex workplace investigation involving safety concerns

The role of an independent consultant is not simply to confirm what leadership already believes.

It is to help leadership reduce uncertainty, challenge assumptions, evaluate the available information, and understand its options.

What should an employer do when an employee's behavior is concerning?

An employer should begin by documenting observable behavior, separating facts from assumptions, determining whether the behavior represents a change or escalation, gathering relevant information, and deciding whether the issue can be managed through ordinary workplace processes or requires a structured behavioral threat assessment.

Should an employer wait until an employee makes a threat?

No.

A direct threat is not necessarily required before concerning behavior warrants evaluation.

A pattern of escalating behavior, fixation, boundary violations, targeted conduct, or other circumstances may justify additional assessment.

Does concerning behavior mean an employee will become violent?

No.

Concerning behavior should not automatically be interpreted as evidence that violence will occur.

The purpose of assessment is to understand the situation and determine appropriate preventive or management action.

Should HR investigate concerning employee behavior?

HR may have an important role in gathering employment-related information and coordinating an organizational response.

Depending on the circumstances, however, HR may need assistance from security, legal counsel, behavioral-health professionals, law enforcement, or an experienced threat-assessment professional.

What should an employer document?

Employers should document relevant observations, reports, communications, dates, circumstances, information gathered, decisions, actions taken, and the rationale for significant decisions.

The documentation should distinguish verified facts from interpretations.

What if the concern turns out to be unfounded?

Responsible assessment can conclude that a concern does not indicate significant risk.

That is not a failure.

The purpose of assessment is to reduce uncertainty and support sound decision-making—not to produce a predetermined conclusion.

When should an employer conduct a formal threat assessment?

A formal threat assessment may be appropriate when concerning behavior is escalating, there is a pattern of conduct, credible threats or communications exist, there is fixation or targeted behavior, there are access or stalking concerns, or the organization lacks sufficient information or expertise to responsibly evaluate the situation.

The Bottom Line

When an employee's behavior raises concern, the employer's first responsibility is not to decide whether the employee is dangerous.

It is to recognize the concern, establish the facts, understand the context, identify what is unknown, and determine what decision needs to be made.

The process should be deliberate without becoming paralyzed by uncertainty.

It should be cautious without automatically becoming alarmist.

And it should remain focused on behavior and evidence rather than labels or assumptions.

The earlier the conversation, the more options leaders have.

Clarity before crisis means giving leadership the information, structure, and decision-making discipline necessary to act while there are still options.

Related Resources

Behavioral Risk & Threat Assessment

Workplace Violence Prevention

Workplace Vulnerability Assessment

Workplace Investigations

P.R.E.V.A.I.L.™ Leadership System

Executive Advisory Services

About the Author

Joseph Paul Manley, M.A.

Paul Manley is a Board-Certified Workplace Violence & Threat Specialist and Founder & Principal Independent Security Consultant of Risk Mitigation Technologies LLC.

With more than 35 years of public safety, law enforcement, corrections, investigations, crisis leadership, and organizational risk experience, Manley advises leaders on behavioral risk recognition, threat assessment, workplace violence prevention, workplace investigations, and high-risk employment decisions.

He is a member of the International Association of Professional Security Consultants (IAPSC) and serves as an adjunct faculty member teaching criminal justice, behavioral sciences, and security studies.

His work is grounded in a simple principle:

The earlier the conversation, the more options leaders have.

Sources

U.S. Secret Service, National Threat Assessment Center. Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence.

U.S. Secret Service, National Threat Assessment Center. Mass Attacks in Public Spaces: 2016–2020.

Federal Bureau of Investigation. Threat Assessment Teams: Workplace and School Violence Prevention.

Occupational Safety and Health Administration. Workplace Violence Prevention Programs and related guidance.