Something has shifted. An employee's behavior has changed in a way that is hard to name precisely but impossible to ignore. They have made a comment that landed wrong. They have had a series of interactions with colleagues that have been reported to HR. They sent an email that someone flagged. Or they were terminated last week and the conversations since have been unsettling.
What do you do next?
This question is asked by HR professionals and General Counsel every day. Most of them are well-intentioned and none of them were trained for this moment. The following framework does not replace professional threat assessment — in situations involving specific threats, escalating behavior, or high-stakes decisions, it should prompt you to call one. But it will give you a structured way to think through what you are seeing and what steps actually reduce risk rather than increasing it.
Step One: Take the Report Seriously
The most dangerous response to a concern is dismissal. “That's just how he is.” “She would never actually do anything.” “He's venting.” These statements may be accurate. They may also be the last thing colleagues say before they are required to explain themselves to investigators.
The standard in behavioral threat assessment is not “I believe this person will act.” The standard is “this behavior warrants evaluation.” Those are not the same thing, and they do not require the same evidence.
When a report comes in:
- Document it in writing immediately — what was said or observed, by whom, when, and in what context
- Treat the reporter with seriousness — they took a risk by coming forward
- Do not share the concern broadly — information about a potential threat situation should be on a strict need-to-know basis
- Do not confront the subject — not yet, and possibly not without professional guidance
Step Two: Gather What You Know
Before any assessment can be conducted — by you or by an outside specialist — you need a factual baseline. This is not an investigation at this stage. It is an information inventory.
Gather:
- The specific behavior or communication that triggered the concern — documented in as much detail as possible
- Any prior incidents, complaints, or HR interactions involving this individual
- The individual's current employment status and any recent employment actions (discipline, performance management, termination)
- The nature of the relationship between the individual and any identified targets
- Any observable changes in the individual's situation — personal stressors, financial problems, social isolation, changes in behavior or appearance
This information does not need to be complete before you take action. It needs to be sufficient to make an informed decision about the next step.
Step Three: Assess the Baseline Risk Level
Not all concerning behavior represents the same level of risk. A rough triage:
Lower urgency — monitor and document
- A single out-of-character comment with no history of similar behavior
- General expressions of frustration or unhappiness without a specific target or threat
- Behavior that is concerning but has a plausible non-threatening explanation
Moderate urgency — convene and assess
- Repeated concerning behavior over time
- A grievance that is escalating in intensity or frequency
- A recent significant stressor (termination, discipline, personal loss) combined with prior concerning behavior
- Comments that reference harm without making a direct threat
High urgency — involve professionals now
- A direct or veiled threat against a specific person or place
- Any mention of weapons
- Behavior suggesting active planning or surveillance
- Communications that indicate the subject perceives themselves as having no other options
If you are at high urgency, the conversation with an outside threat assessment professional should happen today, not after you have gathered more information.
Step Four: Do Not Investigate Alone
The most common mistake HR makes with employee of concern situations is treating them as HR investigations — a process designed for policy violations, not for threat assessment.
The goals are different. An HR investigation asks: what happened and did it violate policy? A threat assessment asks: does this person pose a risk of targeted violence, and how should that risk be managed? The methodology is different. The expertise required is different. The documentation standard is different.
If the situation involves concerning behavior without a clear policy violation — which is the majority of cases — an HR investigation is the wrong tool. If the situation involves behavior that is both a policy concern and a safety concern, both processes may be needed, but they should be kept separate.
When to involve outside expertise:
- Any time a direct or specific threat has been made
- Any time you are uncertain how seriously to take the behavior
- Any time the subject is being terminated and the termination itself is a risk factor
- Any time the subject has access to the workplace that you cannot easily restrict
Step Five: Think About Access
One of the most concrete risk-reduction actions available is limiting or eliminating the subject's access to the people or places they have identified — explicitly or implicitly — as targets.
For a current employee, this may mean:
- A temporary reassignment or administrative leave while the situation is assessed
- Limiting access to certain parts of the facility
- Changing work schedules to reduce contact with specific individuals
For a terminated employee:
- Immediately revoking physical access credentials — badges, codes, fob access
- Immediately revoking electronic access — email, systems, VPN
- Preserving all communications and records from that individual
- Notifying security, reception, or facilities of the individual's status
Access restriction is not an accusation. It is a precaution. It can be explained as a standard administrative step. It is significantly easier to do proactively than reactively.
Step Six: Involve Legal Before You Act
Before you terminate, discipline, confront, or take any formal action with an individual who is a concern, involve your General Counsel or outside employment counsel.
The reason is that the actions most intuitively associated with “handling” a threatening employee — termination, confrontation, no-contact orders — are sometimes the highest-risk moments in a threat trajectory. A termination that is handled poorly, communicated carelessly, or conducted without safety planning can escalate a situation that was manageable into one that is not.
Counsel needs to be part of the decision on:
- Whether and how to confront the individual
- The timing and format of any termination
- Whether a protective order or restraining order is appropriate
- What can and cannot be said to other employees about the situation
Step Seven: Document Everything
Documentation is not bureaucratic self-protection, though it is that too. It is the evidentiary foundation that allows you to demonstrate — to a threat assessment professional, to a protective order judge, to an investigator, or to a jury — that you took the situation seriously and acted responsibly. took the situation seriously and acted responsibly.
Document:
- Every report received, with date, time, witness, and verbatim content where possible
- Every action taken and the reasoning behind it
- Every person informed and what they were told
- The outcome of any assessment or consultation
- Any subsequent behavior by the subject — communications, appearances, third-party reports
Maintain this documentation separately from the general personnel file, with restricted access, and preserve it indefinitely for any matter that resulted in a threat assessment or formal intervention.
When Should You Call a Threat Assessment Professional?
The honest answer is: sooner than you think.
The cost of an outside consultation is measured in thousands of dollars. The cost of a workplace violence incident — human, legal, organizational — is measured in millions, and in consequences that money cannot address.
A professional behavioral threat assessment uses a validated, documented methodology — a structured professional judgment (SPJ) instrument such as the KTI-W, Kestralis Group's proprietary instrument, or the WAVR-21, the instrument most widely trusted in the broader field — to evaluate the available behavioral information and produce a structured finding on risk level and recommended management actions. That finding is defensible, documented, and gives you a basis for the decisions that follow.
If you are uncertain whether a situation warrants a professional assessment, that uncertainty is itself a signal. In behavioral threat assessment, it is almost always better to assess and find the risk is manageable than to not assess and discover you were wrong.
Kestralis Group conducts behavioral threat assessments using the KTI-W, our proprietary structured professional judgment instrument, backed by licensed investigative capability when the situation warrants it. If you have a situation that needs assessment now, contact us directly. For organizations that want to build internal capacity, we design and stand up Threat Assessment Teams through a structured engagement.
