A troubling message, a fixation on a coworker, repeated violations of a protection order, or a sudden escalation in hostile behavior can force a leadership team to make decisions before it has perfect information. The right workplace violence questions do not turn managers into investigators. They give HR, security, and leadership a disciplined way to identify risk, preserve facts, and mobilize the people responsible for protection.
The goal is not to predict violence with certainty. It is to assess whether a person, situation, or pattern of behavior presents a credible concern that requires intervention, monitoring, emergency action, or all three. A missed concern can endanger people. An overreaction can damage trust and create legal exposure. Structured questions help teams act proportionately.
Start With the Question: Is There an Immediate Danger?
The first assessment is simple and urgent: Is anyone at immediate risk of harm right now? If the answer may be yes, the organization should activate emergency procedures and contact law enforcement or emergency services as appropriate. Do not delay action while trying to complete a full internal assessment.
Ask whether the person has made a direct or implied threat, has access to the intended target, knows where the target is located, or has recently appeared at a workplace, home, or event without authorization. Also ask whether there is evidence of a weapon, stalking, physical assault, property damage, or escalating contact.
A threat does not need to include a specific statement such as, “I will hurt you,” to merit action. Language such as “They will be sorry,” “I have nothing left to lose,” or “You will see what happens” can carry meaning when paired with grievance, access, and escalating conduct. Context determines urgency.
Workplace Violence Questions for a Credible Threat Assessment
Once immediate safety is addressed, the team needs to separate rumor from observable behavior without dismissing concerns. A credible assessment examines facts, patterns, capability, and protective factors.
What happened, exactly?
Require a clear account of the conduct. What was said or done? Who observed it? When and where did it occur? Was the communication in person, by phone, through social media, or through a third party? Capture exact language where possible rather than relying on labels such as “aggressive” or “unstable.”
This question is foundational because vague reporting produces vague decisions. “He was threatening” is less useful than “He told his supervisor, ‘You are going to regret this,’ after being told his access badge was deactivated.” The second account can be evaluated, corroborated, and documented.
Is there a pattern of escalation?
Single events matter, but behavior over time often reveals more. Has the individual moved from complaints to harassment, surveillance, threats, or unwanted visits? Have others reported similar interactions? Did a recent disciplinary action, termination, relationship conflict, financial crisis, or legal dispute increase the level of grievance?
Escalation is not always linear. A person may appear calm immediately before taking harmful action. Still, a growing frequency, intensity, or specificity of concerning behavior should raise the level of scrutiny and protective planning.
Does the person have intent, means, and access?
These are central workplace violence questions because they move the assessment beyond general concern. Intent may be explicit or inferred from statements, fixation, planning behavior, or attempts to obtain information. Means can include weapons, but also vehicles, tools, knowledge of security procedures, or the ability to recruit others.
Access matters just as much. Can the person enter the facility, reach a particular employee, view schedules, or exploit remote-work practices? A former employee whose credentials were disabled may still know shift changes, parking locations, and building entry routines. Protective measures should account for the access that remains, not only the access that was formally revoked.
Is there evidence of planning or fixation?
Planning indicators can include researching a target’s location, photographing entrances, asking about schedules, acquiring weapons or tactical equipment, testing security boundaries, or making finalizing statements. Fixation may appear as persistent, unwanted contact or an inability to let go of a perceived injustice.
No single indicator proves intent. The concern rises when several indicators converge. A person who is angry after termination requires attention. A person who is angry, repeatedly contacts a supervisor, asks where that supervisor parks, and appears near the site requires immediate coordinated action.
Who else may be at risk?
The identified target is not always the only person who needs protection. Coworkers, reception staff, security officers, family members, and employees who may be perceived as allies can also be exposed. Ask whether the concern involves intimate partner violence, a custody dispute, or a conflict outside work that could enter the workplace.
Organizations have a duty to think beyond the individual report. This may mean changing work locations, adjusting arrival and departure routines, providing escorts, notifying relevant personnel on a need-to-know basis, and creating a clear emergency contact path.
Ask Questions That Improve the Response
Assessment without operational follow-through creates a false sense of control. After identifying a concern, leadership should ask what must happen next, who owns each action, and how the organization will verify completion.
First, ask: What protections are needed today? Options may include access-control changes, security presence, employee escorts, remote-work arrangements, restraining-order coordination, law enforcement notification, or a welfare check. The right measure depends on the threat, the site, and the people involved. Not every case requires the same response, but every case needs an accountable decision.
Next, ask: Who needs to know? Share information narrowly but effectively. Security may need a photo and vehicle description. A front desk team may need instruction not to admit a former employee. A manager may need a communication plan for the affected employee. Broad distribution of sensitive personal information can create privacy and employment-law concerns, so use role-based notifications and document why information was shared.
Then ask: How will we document and preserve evidence? Retain reports, screenshots, voicemails, access logs, video footage, witness statements, and relevant HR records according to policy and legal requirements. Establish a case record with dates, decisions, assigned owners, and follow-up deadlines. If the situation later escalates, the organization should be able to show what it knew, when it knew it, and what it did to protect people.
Questions Leaders Should Not Ask
Certain questions weaken the assessment because they substitute assumptions for evidence. “Would they really do that?” is not useful. People rarely fit a simple profile, and violence prevention should not depend on a manager’s personal impression.
Avoid asking whether someone is “mentally ill” as a shortcut for risk. Mental health information may be private, incomplete, or irrelevant. Focus on observable behavior, communicated threats, access, planning, and escalation. The question is not whether someone seems unusual. The question is whether their behavior creates a safety concern that warrants action.
Leaders should also avoid treating a threat as less serious because it occurred offsite, after hours, or online. If conduct affects an employee’s safety, the workplace may still be part of the risk environment. Hybrid work has widened the operational perimeter. Home addresses, virtual meeting links, travel routines, and public social profiles can all become relevant.
Build a Repeatable Assessment Process
A credible process is more than a policy stored in a shared drive. It identifies who receives reports, who conducts initial triage, when a multidisciplinary threat assessment team is activated, and how urgent cases are escalated. HR, corporate security, legal counsel, leadership, and local law enforcement may each have a role, but roles must be clear before an incident occurs.
Teams also need a way to centralize information that is often scattered across emails, HR files, security reports, and text messages. Fragmented records obscure patterns. Centralized case management supports consistent documentation, evidence handling, task assignment, and auditability while giving decision-makers a current view of the threat.
Technology can strengthen the process when it supports, rather than replaces, human judgment. Threat monitoring can surface relevant risks. Location-based intelligence can help teams understand exposure around offices, events, and executive travel. Analyst review can reduce false positives and provide context before an alert drives a major response. Risk Shield is built around this operational model: intelligence, verification, escalation, and documented action in one coordinated environment.
Turn Concern Into Protective Action
The strongest workplace violence program gives employees a clear route to report concerns without requiring them to decide whether a threat is “serious enough.” It trains managers to listen, record facts, and escalate promptly. It gives security and leadership the tools to assess, coordinate, and close the loop.
When a report arrives, the most valuable question may be the most direct: What do we need to do now to keep people safe? Asked early, answered with discipline, and followed by documented action, that question can change the outcome.
