When an employee makes a comment that unsettles a manager, or a termination goes badly, or someone reports that a coworker has been talking about a grudge, the call in most mid-sized organizations goes to human resources. That is a reasonable instinct. HR knows the people, holds the personnel file, and owns the disciplinary process. But in my experience, the organizations that treat HR as their threat assessment team are asking one department to carry a responsibility that requires several, and the gap only becomes visible when a situation gets serious. If you are an executive who has assumed HR has this covered, this article explains why HR should not be your threat assessment team and what should be in its place.
I want to be clear at the outset that this is a statement of respect for HR rather than a criticism of it. The HR professionals I have worked with across my career are often the first to say that they are being handed situations they were never trained to evaluate. They know how to manage performance, investigate policy violations, and handle a separation lawfully. Evaluating whether a person is moving toward violence is a different discipline, and it is unfair to the HR team and dangerous to the organization to pretend otherwise.
What Threat Assessment Actually Requires
Threat assessment is a structured process for determining whether a person of concern poses a risk of harm and for managing that risk over time. It draws on behavioral indicators, the person’s history and circumstances, their access to the organization and to the people in it, and the trajectory of their behavior rather than any single statement. The people who do this work well have been trained in it, have seen enough cases to recognize patterns, and know the difference between someone who makes a threat and someone who poses one. Those two categories overlap far less than most managers expect.
The process also requires information that no single department holds. HR has the personnel record. Security knows who has physical access, what the person has been doing at the doors, and what the cameras have captured. Legal understands the exposure and the constraints. The person’s direct supervisor knows what has changed in their behavior over the past month. IT can tell you whether the person has been pulling files they have no business pulling. When one department evaluates a concern alone, it evaluates it with a fraction of the picture, and the decision that follows is only as good as that fraction.
Where HR Alone Gets Into Trouble
The most common failure I have seen is the concern that gets handled as a personnel matter when it was a safety matter. The employee receives a written warning or is walked out, the file is closed, and nobody asks what the person is likely to do next or who in the organization they blame. The disciplinary process has an ending. A threat assessment does not end at termination, because termination is often the moment when risk goes up rather than down. HR is built to close cases. Threat management is built to keep watching.
The second failure is the opposite one. An HR team that has been burned once may begin treating every angry remark as a crisis, which exhausts the organization, damages trust with employees, and buries the concerning case among the ordinary ones. Calibration comes from training and from seeing cases evaluated by people who have seen many of them. It does not come from a single department carrying the weight alone and hoping its judgment holds.
The third failure is structural. HR reports to leadership on matters of employment, and its instincts are shaped by employment risk. Security concerns sometimes require actions that sit uncomfortably with that lens, such as notifying law enforcement, changing access, or briefing a receptionist on a person to watch for. When the department that owns the process is also the department most worried about the employment consequences, the harder calls tend to be delayed.
What a Real Team Looks Like
The model that works in organizations of any size is a small standing team with a defined leader, a defined process, and defined membership. The leader should be someone trained in threat assessment, whether that is a security director, a fractional security director, or an outside professional on retainer. HR is a permanent member of that team and one of its most important voices. Legal is a member. A senior operations leader is a member so that decisions can actually be executed. IT and facilities are brought in as needed. The team meets when a concern is raised, and it also meets on a schedule to review open cases, because concerns that are not actively reviewed have a way of being forgotten until they resurface.
The team needs a written process that answers a few plain questions. How does a concern get reported, and by whom? Who convenes the team and how quickly? What information does each member bring? How is the concern documented, and where does that record live so that it is protected and retrievable? What are the options for managing the situation, from a conversation to a change in access to a referral to law enforcement? Who decides, and who is told? Written down, this fits on a few pages. Left unwritten, it gets improvised in the worst week of the year.
How to Build This Without a Full-Time Security Department
Most mid-sized organizations do not have a security director, and that is usually why HR ended up with the job by default. The practical path is to identify one person who will own the process and then get that person trained. Threat assessment training is available through professional associations and through experienced practitioners, and a few days of it changes how a leader sees these situations. If nobody inside the organization can take that on, a part-time security executive can lead the team and build the process, which is a large part of what I do in fractional engagements.
Next, name the team in writing and brief every manager on how to report a concern. Managers are the sensors of the whole system, and most of them do not know that a process exists or what belongs in it. Then run a tabletop exercise with a realistic scenario, such as a disgruntled employee being separated, and walk the team through it before a real one arrives. Finally, establish the relationship with your local law enforcement agency now, while nothing is happening, so that the first call is a check-in rather than an introduction.
Test It Before You Need It
A threat assessment process on paper is an assumption until it has been exercised. I have seen organizations with a well-written policy discover during a drill that the reporting line went to a person who had left the company, or that the team had never been told it was the team. The principle I lay out in Until Tested: Security Is Only Assumed applies here as much as it does to locks and alarms. Run the scenario, note what breaks, fix it, and run it again next year. That discipline is what separates a program from a document.
Keep HR at the center of this work. Give HR the partners, the leader, and the process the work requires. That is how you protect your people and your HR team at the same time.
Go Deeper
Building a threat assessment team is one of the first things a security leader puts in place, and it is a good example of why the role matters. For the full picture of what that leader does and how a part-time model works, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director covers the threat management process in detail.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply