Skip to main content
KestralisKestralis

— Threat Assessment

What Is the WAVR-21 — And Why It Matters for Your Workplace Threat Assessment

John Scheffler, CBCP · Principal, Kestralis Group
9 min
Professional conducting a structured assessment review in a modern office

When a threat assessment professional evaluates whether an individual poses a risk of targeted workplace violence, the quality of that assessment depends entirely on the methodology behind it. An assessment based on gut instinct, informal observation, or a checklist pulled from a policy manual is not a threat assessment — it is an opinion. The difference matters when that opinion is the basis for a termination, a protective order application, or a decision to do nothing.

The WAVR-21 — Workplace Assessment of Violence Risk — is the structured professional judgment instrument that defines the standard of care in the field. This article explains what it is, how it works, and why it matters to your organization.

What Is the WAVR-21?

The WAVR-21 is a 21-item coded assessment instrument developed by Drs. Stephen White and Reid Meloy — two of the most respected authorities in behavioral threat assessment — specifically for evaluating the risk of targeted workplace and campus violence.

It is used by corporate security teams at major employers, university behavioral intervention teams, government protective intelligence programs, and law enforcement agencies. It is the instrument most frequently referenced in the threat assessment literature and the one most widely trusted by practitioners with actual casework experience.

The instrument was updated in its third edition (WAVR-21 V3) to address both workplace and campus settings, reflecting decades of empirical research on the behavioral pathways that precede targeted violence.

What “Structured Professional Judgment” Means

The WAVR-21 is a structured professional judgment (SPJ) tool. This is a specific category of risk assessment methodology that sits between two extremes:

Unstructured clinical judgment — a professional's informal opinion based on observation and experience, with no standardized framework. This approach is fast and flexible but produces inconsistent results across assessors and is difficult to defend when challenged.

Actuarial assessment — a purely statistical approach that assigns risk scores based on population-level data. This approach is consistent but poorly suited to the individualized, dynamic nature of targeted violence risk.

Structured professional judgment uses a defined set of evidence-based risk factors as the framework for assessment, then applies professional judgment to evaluate how those factors apply to the specific individual and circumstances. The result is an assessment that is both consistent — because it evaluates the same factors in every case — and individualized — because the weight and interaction of those factors is interpreted by a trained professional.

For legal and organizational purposes, this matters because the assessment is documented and reproducible. Another trained assessor, reviewing the same information through the same framework, should reach a substantially similar conclusion.

The 21 Items

The WAVR-21 evaluates 21 risk factors organized into dynamic and static categories.

Dynamic factors — those that can change over time, and that should be monitored as part of ongoing case management — include items such as:

  • Pathway warning behaviors (whether the individual is progressing toward an attack)
  • Fixation and focus on a specific grievance, target, or outcome
  • Leakage — communications that reveal intent or planning
  • Directly communicated threats
  • Weapons access and interest
  • Emotional dysregulation

Static and contextual factors — those that provide background context for interpreting the dynamic findings — include items such as:

  • History of violence and criminal behavior
  • Recent losses and personal stressors
  • Psychosocial factors
  • Employment history and workplace conduct

No single factor is determinative. The WAVR-21 does not produce a numerical score that automatically categorizes a subject as high, medium, or low risk. It produces a structured professional judgment — a documented evaluation of the evidence, the relevant factors, and the clinical reasoning — that places the individual on a continuum of concern and guides case management decisions.

What the Assessment Produces

A WAVR-21 assessment produces two outputs: a risk judgment and a case management plan.

The risk judgmentcharacterizes the level of concern — typically described as low, low-moderate, moderate, moderate-high, or high — and identifies the specific behavioral drivers that underlie it. This judgment is not a prediction of violence. It is an assessment of the degree to which the available information suggests that the individual may be on a pathway toward targeted violence.

The case management planidentifies the specific actions recommended based on the risk judgment — monitoring protocols, intervention options, access restrictions, protective measures for identified targets, and the conditions under which the case should be reassessed or escalated.

This combination — a defensible risk characterization and an actionable management plan — is what organizations need to make responsible decisions about an individual who has become a concern.

Why Methodology Matters

Organizations that make significant decisions based on unstructured, undocumented threat assessments expose themselves to two categories of risk.

False negative risk — underestimating a genuine threat because the assessment was informal and missed indicators that a structured methodology would have identified. This is the risk that ends careers and organizations.

False positive risk — overreacting to a situation that was not genuinely threatening, resulting in wrongful termination, legal liability, and the loss of an employee who was never actually dangerous. This risk is less obvious but equally consequential.

Structured professional judgment reduces both risks — including the legal exposure that follows from inadequate assessment — by requiring that the assessment cover a defined set of evidence-based factors and document the reasoning behind the conclusion. It does not eliminate error — no methodology does — but it provides a basis for review, a defense of the decision, and a framework for ongoing monitoring.

Who Should Be Conducting WAVR-21 Assessments

The WAVR-21 manual specifies that the instrument should be used by practitioners with training in violence risk assessment and threat assessment methodology. It is not a self-service tool. Applying it effectively requires understanding not just the items but the research behind them, the case patterns that inform the weightings, and the clinical judgment that makes the structured framework useful rather than mechanical.

In practice, this means organizations facing a serious concern should engage a trained threat assessment professional rather than attempting to apply the framework through an HR generalist or a policy checklist. The training and experience required to use the instrument well are not acquired in an afternoon.

What This Means for Your Organization

If your organization has a Threat Assessment Team, the WAVR-21 should be part of its operating methodology. Team members who will be applying the framework should receive formal training on its use.

If your organization does not have a Threat Assessment Team — which describes the majority of mid-market employers — you should have access to an outside professional who uses the WAVR-21 when a situation warrants assessment. Waiting until a crisis to identify that resource is, at minimum, inefficient. At worst, it is dangerous.

The situations that most commonly require external threat assessment support are also the situations in which response time matters most. Having the relationship established before you need it is the operationally sound approach.


Kestralis Group conducts WAVR-21 behavioral threat assessments for organizations across all industries. We also design and stand up internal Threat Assessment Teams for organizations ready to build that capability. Contact us to discuss your situation.

— About the author

John Scheffler, CBCP

Principal, Kestralis Group

— Get in touch

Questions about what you just read?

We're happy to discuss how this applies to your organization. Reach out for a confidential conversation.