When Does a Workplace Concern Become a Threat Assessment?

When does a workplace concern become a threat assessment?

The answer is not simply, “when someone makes a threat.”

A concerning comment, angry interaction, policy violation, grievance, behavioral change, or conflict may be significant—or it may be a routine management issue with no indication of violence.

The challenge for leaders is recognizing when a concern has moved beyond ordinary management and requires a more structured assessment of behavioral risk.

A workplace concern may warrant a threat assessment when the available behavior, circumstances, communications, or pattern of conduct raises enough concern that routine management processes alone may no longer be sufficient to responsibly evaluate and manage the situation.

That distinction matters.

Waiting until behavior becomes an obvious threat can leave leaders with fewer options. Treating every concerning behavior as evidence of impending violence can create unnecessary disruption and potentially harmful decisions.

The objective is neither to minimize the concern nor to overreact.

The objective is to recognize meaningful behavioral risk early enough to make a clear, informed, and defensible decision.

A workplace threat assessment is a structured process for evaluating concerning behavior, circumstances, communications, and other available information to determine whether a person or situation may present a risk of harm to an organization or its people.

The U.S. Secret Service National Threat Assessment Center describes behavioral threat assessment as an approach that identifies individuals displaying threatening or concerning behavior, gathers information, assesses whether the individual poses a risk of violence, and manages that risk through appropriate interventions.

Importantly, behavioral threat assessment is not the same thing as predicting violence.

The Secret Service has stated that these programs are not designed to predict who will become violent. Rather, they are intended to identify, assess, and intervene with individuals displaying concerning behavior that may indicate a risk of harm.

That distinction is important for organizational leaders.

The purpose of an assessment is not to determine whether an employee is “a dangerous person.”

It is to understand the situation well enough to determine what, if anything, should happen next.

Not Every Workplace Concern Is a Threat

One of the most important principles in workplace violence prevention is that concerning behavior does not automatically mean threatening behavior.

An employee may become angry, frustrated, argumentative, withdrawn, or emotionally reactive for many reasons.

A difficult interaction may be a performance-management issue.

A policy violation may require disciplinary action.

A workplace conflict may require intervention.

A threatening communication may require a substantially different response.

The difficulty is that these categories can overlap.

A situation that begins as an employee-relations issue can change over time. Escalating grievance, repeated boundary violations, increasingly hostile communications, fixation on a particular person or organization, retaliatory behavior, or attempts to gain access to a person or location may justify moving from routine management toward a structured threat assessment.

The question should therefore not be:

“Did this person make a threat?”

A more useful question is:

“What do we know about the behavior, the circumstances surrounding it, and the potential for escalation?”

When behavior raises concern, leaders can begin with five fundamental questions.

1. What do we know?

Separate verified information from assumptions, interpretations, rumors, and incomplete reports.

Identify what was actually observed, documented, communicated, or independently confirmed.

For example:

Fact: An employee sent three hostile emails to a supervisor after receiving a disciplinary warning.

Interpretation: The employee is becoming dangerous.

The first statement is information.

The second is a conclusion.

A sound assessment begins with the information.

2. What Don't We Know?

Uncertainty is not a reason to ignore a concern.

It is a reason to identify what additional information may be necessary.

Leaders may need to determine:

• What happened immediately before the concerning behavior?
• Has similar behavior occurred previously?
• Has the individual's behavior changed?
• What does the person believe happened to them?
• Has the grievance become increasingly focused or personal?
• Are there additional communications or incidents?
• Are there known protective factors?
• Who else may have relevant information?

A good assessment identifies both what is known and what remains unknown.

3. Has the Behavior Changed?

Behavioral change can be more informative than one isolated incident.

Consider whether there has been:

• Increasing frequency
• Increasing intensity
• Increasingly direct communication
• Boundary testing
• Fixation
• Escalating grievance
• Attempts to obtain access
• Stalking or unwanted contact
• Retaliatory behavior
• Other conduct suggesting movement toward action

No single indicator proves that violence will occur.

The significance comes from the pattern, context, and convergence of information.

4. What Circumstances Could Increase or Decrease Concern?

Behavior does not occur in a vacuum.

Leaders should consider relevant circumstances and stressors while avoiding unsupported assumptions about an individual's motives or mental health.

The assessment should examine what is happening around the behavior—not simply what the person is doing.

At the same time, organizations should identify protective factors and circumstances that may reduce concern.

Threat assessment is not merely an exercise in finding reasons to be alarmed.

It is an effort to understand the situation accurately.

5. What Decision Needs to Be Made Now?

This may be the most important question.

The purpose of assessment is not to produce an interesting profile.

The purpose is to support responsible decision-making.

Depending on the circumstances, the decision may involve:

• Additional fact-finding
• Management intervention
• HR action
• Workplace accommodations or support
• Security measures
• Changes to access
• Consultation with legal counsel
• Law enforcement notification
• Continued monitoring
• A formal multidisciplinary threat assessment

The appropriate response depends on the facts.

HR professionals are often among the first people to receive reports about concerning employee behavior.

That does not mean HR should be expected to independently determine whether someone represents a threat.

Instead, HR can help identify when a situation may require additional expertise.

Consider seeking a structured threat assessment when there is a combination of concerning behavior, escalation, credible communications, significant grievance, fixation, boundary violations, targeted behavior, or other circumstances that cannot be adequately evaluated through ordinary HR processes alone.

The assessment should remain focused on observable behavior and relevant facts, rather than attempting to diagnose the employee or predict future violence.

Organizations sometimes struggle because they believe they must determine whether someone is definitively “a threat” before taking action.

That creates a false choice.

Leadership does not always need certainty before making a reasonable preventive decision.

Instead, leaders need enough reliable information to determine:

What is happening?

What do we know?

What don't we know?

What decision needs to be made now?

This is what I call the Leadership Decision Point™—the point at which recognition of a concern becomes a deliberate organizational decision.

That decision may be relatively simple.

It may also require HR, legal, security, behavioral-health, or law-enforcement involvement, depending on the circumstances.

The important point is that leaders should not wait for absolute certainty if the available information indicates that additional assessment or preventive action is warranted.

Workplace violence prevention is often discussed in terms of what organizations should do after a threat occurs.

But prevention begins earlier.

There is often a period in which behavior is concerning while the eventual outcome remains uncertain.

That is precisely when leadership has an opportunity to:

• Gather information
• Challenge assumptions
• Establish appropriate boundaries
• Involve the right professionals
• Assess vulnerabilities
• Consider reasonable preventive measures
• Document the rationale for important decisions

The earlier the conversation, the more options leaders have.

This does not mean predicting violence.

It means recognizing when uncertainty itself has become an organizational risk-management problem requiring structured attention.

When a workplace concern emerges, leaders can use a simple sequence:

Recognize → Analyze → Challenge → Decide → Act

Recognize

Identify the behavior or circumstances that caused concern.

Analyze

Examine the available facts, context, patterns, and relevant risk indicators.

Challenge

Test assumptions. What might we be missing? What alternative explanations exist? What information would change the assessment?

Decide

Determine what level of intervention, assessment, monitoring, or protective action is appropriate.

Act

Implement the decision, document the rationale, communicate appropriately, and reassess as new information develops.

This sequence forms the foundation of the P.R.E.V.A.I.L.™ Leadership System developed by Risk Mitigation Technologies.

The underlying principle is straightforward:

Recognition informs decisions. Decisions drive action. Action creates prevention.

Waiting for a Direct Threat

A person does not necessarily need to make an explicit threat before an organization takes a concern seriously.

Concerning behavior may warrant attention before a direct threat occurs.

Treating One Behavior as Proof of Future Violence

No isolated behavior should automatically be treated as proof that violence will occur.

Context matters.

Diagnosing the Individual

Organizations should focus on observable behavior, circumstances, credible information, and risk.

Threat assessment is not a substitute for clinical diagnosis.

Relying Exclusively on Intuition

Experience matters.

But structured assessment can help reduce the influence of assumptions and cognitive bias.

Acting Without Documentation

Significant decisions should have a clear factual basis and rationale, particularly when employment, access, safety, or legal issues are involved.

Assuming That No Violence Occurred Means There Was No Meaningful Concern

Preventive intervention may mean that escalation never occurs.

The absence of an incident does not necessarily mean there was no meaningful risk to manage.

Outside consultation may be appropriate when:

• Behavior is escalating
• The situation involves competing interpretations of risk
• Management, HR, security, or legal personnel disagree about the appropriate response
• There are credible threats or communications
• An individual appears increasingly fixated or grievance-driven
• There are concerns about access, stalking, retaliation, or targeted behavior
• The organization lacks internal threat-assessment expertise
• Leadership needs an independent assessment to support a significant decision

An outside consultant should not simply tell an organization what it wants to hear.

The value of an independent assessment is the ability to examine available information objectively, identify uncertainty, challenge assumptions, and help leadership understand its options.

What Is a Workplace Threat Assessment?

A workplace threat assessment is a structured process for gathering and evaluating information about concerning behavior to determine whether an individual or situation may present a risk of harm and what interventions or management strategies may be appropriate.

Does Someone Have to Make a Direct Threat Before a Threat Assessment?

No.

A direct threat is not necessarily required before an organization begins evaluating concerning behavior.

A pattern of escalating or otherwise concerning behavior may warrant assessment even when no explicit threat has been made.

Is a Threat Assessment the Same as a Workplace Violence Risk Assessment?

Not exactly.

A workplace violence risk assessment may examine broader organizational, environmental, and situational hazards associated with workplace violence prevention.

A behavioral threat assessment generally focuses more specifically on an individual or situation involving concerning behavior and the potential for targeted harm.

The two processes can complement one another.

Can HR Conduct a Threat Assessment?

HR can play an important role in identifying concerns, gathering employment-related information, coordinating organizational response, and participating in an assessment.

However, particularly complex or serious cases may require a multidisciplinary team or outside behavioral threat-assessment expertise.

Does Behavioral Threat Assessment Predict Who Will Become Violent?

No.

Behavioral threat assessment is not designed to predict who will become violent.

Its purpose is to identify, assess, and intervene with individuals displaying threatening or concerning behavior.

What Should Leaders Document?

Leaders should document relevant observations, reported behavior, communications, dates and circumstances, information gathered, decisions made, actions taken, and the factual rationale for significant decisions.

Documentation should distinguish verified facts from interpretations or assumptions.

What If the Concern Turns Out to Be Nothing?

That is one of the realities of responsible prevention.

An assessment may conclude that the concern does not indicate a significant risk.

That does not mean the assessment was unnecessary.

Good assessment is designed to reduce uncertainty—not manufacture certainty.

The Bottom Line

A workplace concern may warrant a threat assessment when the available behavior, circumstances, communications, or pattern of conduct raises enough concern that routine management processes alone may no longer be sufficient to responsibly evaluate and manage the situation.

That determination should be based on behavior, context, patterns, corroborated information, and professional judgment—not labels or assumptions.

The goal is not to predict who will become violent.

The goal is to recognize meaningful risk early, reduce uncertainty, and help leaders make clear, defensible decisions while there are still options.

Clarity Before Crisis™ is not about predicting the future. It is about making better decisions before the future is decided for you.

Behavioral Risk & Threat Assessment

Workplace Violence Prevention

Workplace Vulnerability Assessment

Workplace Investigations

P.R.E.V.A.I.L.™ Leadership System

Executive Advisory Services

About the Author

Joseph Paul Manley, M.A.

Paul Manley is a Board-Certified Workplace Violence & Threat Specialist and Founder & Principal Independent Security Consultant of Risk Mitigation Technologies LLC.

With more than 35 years of public safety, law enforcement, corrections, investigations, crisis leadership, and organizational risk experience, Manley advises leaders on behavioral risk recognition, threat assessment, workplace violence prevention, workplace investigations, and high-risk employment decisions.

He is a member of the International Association of Professional Security Consultants (IAPSC) and serves as an adjunct faculty member teaching criminal justice, behavioral sciences, and security studies.

His work is grounded in a simple principle:

The earlier the conversation, the more options leaders have.

Sources

U.S. Secret Service, National Threat Assessment Center. Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence.

U.S. Secret Service, National Threat Assessment Center. Mass Attacks in Public Spaces: 2016–2020.

Federal Bureau of Investigation. Threat Assessment Teams: Workplace and School Violence Prevention.

Occupational Safety and Health Administration. Workplace Violence Prevention Programs and related guidance.