Workplace Security

Behavioral Threat Assessment Team: How to Build One That Works

By the FASC editorial team Updated Nov 4, 2026 5 min read
Multidisciplinary behavioral threat assessment team reviewing a case around a conference table

A behavioral threat assessment team is a small, multidisciplinary group inside an organization that receives reports of concerning behavior, gathers facts, judges whether a person is on a path toward violence, and puts a plan in place to reduce the risk. The focus is on behavior and circumstances, not profiles or stereotypes. Workplaces, schools, hospitals and houses of worship use these teams to step in early, long before a situation turns into an emergency.

Threat assessment team key takeaways

  • Threat assessment asks whether someone poses a threat, not just whether they made one.
  • An effective threat assessment team brings together HR, security, legal, management and mental health expertise, with clear authority to act.
  • The process follows a cycle: identify, gather information, assess, manage and monitor.
  • Most cases end with support and management (counseling, accommodations, supervision changes), not discipline or police involvement.
  • Written procedures, training and confidential reporting channels matter as much as the threat assessment team itself.

Why do organizations need a threat assessment team?

Targeted violence is rarely sudden. People who commit it often move along what threat assessment professionals call a “pathway to violence”: a grievance, then thoughts of violence, research and planning, preparation, and finally action. Along the way, they frequently do or say things that worry the people around them. Many reveal their intent to others before acting, something practitioners call leakage.

The problem is that those warning signs are usually scattered. A coworker hears a comment, a manager notices a change in behavior, HR has a complaint on file, and security saw the person at the building after termination. A threat assessment team gives all of those pieces one place to land.

The model is well established. The US Secret Service National Threat Assessment Center has published guidance for schools built on this approach, and ASIS International publishes an American National Standard on workplace violence prevention that calls for a multidisciplinary threat management function.

Threat assessment team: Managers reviewing a workplace violence prevention plan with employees in a meeting room

Who should be on a behavioral threat assessment team?

Keep the core threat assessment team small enough to meet quickly, usually four to seven people, with others called in as needed.

Role What they contribute
Team lead (often security or HR) Runs the process, convenes meetings, keeps cases moving and documented
Human resources Employment history, policies, discipline options, accommodations
Security Physical protective measures, access control, coordination with law enforcement
Legal counsel Privacy, employment law, disability law, documentation and liability
Mental health professional Insight into behavior and referral options, often through an employee assistance program or outside consultant
Senior management representative Authority to approve actions and resources quickly
Ad hoc members The person’s manager, IT, facilities or a law enforcement liaison when relevant

In schools, a threat assessment team typically includes an administrator, a counselor or school psychologist, a school resource officer or other law enforcement partner, and a teacher or staff member who knows the student.

How does the threat assessment process work?

  1. Identify. Employees, students or the public report concerning behavior through clear, well publicized channels, including anonymous options.
  2. Triage. The team lead quickly decides whether there is an imminent danger (call 911 and act now) or whether the case needs a full assessment.
  3. Gather information. Interview witnesses and, when appropriate, the person of concern. Review records, communications and any prior incidents.
  4. Assess. The threat assessment team asks structured questions: Is there a grievance? Has the person communicated intent? Are there signs of planning or acquiring weapons? What stressors and protective factors are present?
  5. Manage. Build a case plan that reduces risk. That may include support services, workplace changes, a fitness for duty review, protective measures for a target, or law enforcement involvement.
  6. Monitor and close. Follow up on the plan, reassess when circumstances change, and document why the case was closed.

A simple example

Picture an employee who was passed over for promotion and has started making bitter comments about his manager, including one remark that “someone should make her pay.” A coworker reports it. The team reviews his file, talks with the coworker and the manager, and learns he is also going through a divorce. There is no sign of planning or weapons. The plan: a meeting with HR to address the conduct, a referral to the employee assistance program, a change in reporting line, and a check in after 30 days. The case stays open until the threat assessment team is satisfied the risk has dropped.

Threat assessment team: Employees in a conference room during an active shooter preparedness training session

What behaviors should trigger a referral?

Every threat assessment team should publish examples so people know when to speak up. Common concerns include:

  • Direct, indirect or conditional threats, including in email, texts or social media
  • Talking about or showing unusual interest in past attacks or weapons
  • Intimidation, stalking or harassment of a coworker, student or former partner
  • A strong grievance combined with blaming others or talk of revenge
  • Major, unexplained changes in behavior, especially after a loss, termination or discipline
  • Domestic violence that may follow someone to the workplace

The message to staff should be simple: you do not have to decide whether something is serious. Report it, and the threat assessment team will assess it.

What are the most common mistakes?

Treating it as a discipline process

If the only outcome is firing or expelling the person, you may increase their grievance and remove your ability to monitor them. Good teams think about what happens the day after a termination, not just the meeting itself.

Waiting for a direct threat

Many people who attack never threaten their target directly. A threat assessment team that only acts on explicit threats will miss most of the cases it exists to catch.

Working without written procedures

Without written procedures, case decisions depend on who happens to be in the room. Document the team’s authority, roles, confidentiality rules, recordkeeping and how cases are opened and closed.

Never training together

A threat assessment team should train on the process and run tabletop exercises with realistic cases before it faces a real one. The Association of Threat Assessment Professionals (ATAP) is one source of professional training and the Certified Threat Manager credential.

Threat assessment team: Hospital corridor with nurses, illustrating healthcare workplace violence prevention

How does a threat assessment team fit with your other programs?

A threat assessment team is one part of a larger violence prevention effort. In California, it supports the reporting, investigation and post incident requirements in a workplace violence prevention plan under SB 553. In hospitals, it pairs with the measures in our guide to healthcare workplace violence prevention. Federal guidance on workplace violence is available from OSHA.

Many organizations bring in an outside consultant to design the program, write procedures, train the team and serve as an on call advisor for difficult cases. You can find experienced professionals on our behavioral threat assessment page or among workplace violence prevention specialists. For budgeting, see the workplace violence prevention cost guide.

Ready to build or strengthen your threat assessment team?

Tell us about your organization and where you are today, whether you are starting from scratch or need help with a difficult case. We will match you with independent behavioral threat assessment consultants and send you proposals at no cost.

Request free proposals

Frequently asked questions

What is the difference between threat assessment and profiling?

Profiling tries to predict violence from traits such as age, background or personality, which does not work and can be discriminatory. Behavioral threat assessment focuses on what a specific person is saying and doing, their circumstances and whether they are moving toward an attack. It is fact based, case by case, and aimed at intervention rather than labeling.

Does a small organization need a threat assessment team?

Even a small employer benefits from a defined process. The team can be as simple as an owner or manager, an HR resource and an outside advisor such as an attorney or threat assessment consultant who can be called in quickly. What matters most is a clear way to report concerns and a plan for who decides what happens next.

Should law enforcement be on the team?

Many teams have a law enforcement liaison rather than a permanent member, especially in workplaces. Police involvement is essential when there is an imminent threat or a crime, but most cases are managed through support, supervision and workplace measures. Schools often include a school resource officer. Decide in advance when and how you will involve police.

How confidential are threat assessment cases?

Cases should be handled on a need to know basis, with records stored securely and separate from routine personnel files where appropriate. Confidentiality has limits: if someone may be in danger, the team must act and may need to share information with targets or law enforcement. Legal counsel should help set the rules in your written procedures.

How long does it take to set up a behavioral threat assessment team?

A basic team can be formed in weeks: select members, adopt written procedures, set up reporting channels and train together. Building real skill takes longer and comes from ongoing training, tabletop exercises and handling cases. Many organizations use an outside consultant to speed up setup and provide guidance on the first difficult cases.

Leave a Reply

Your email address will not be published. Required fields are marked *