How to Implement a Behavioral Threat Assessment (BTAM) Model in the Workplace
Building a Proactive, Evidence-Based Approach to Workplace Violence Prevention
Workplace violence rarely develops in a vacuum. In some cases, individuals exhibit concerning behaviors, communicate grievances, make threats, or demonstrate escalating hostility before an incident occurs. Recognizing and evaluating these warning signs creates opportunities for organizations to intervene before a situation becomes dangerous.
A Behavioral Threat Assessment and Management (BTAM) model provides employers with a structured, evidence-informed approach to identifying, assessing, and managing individuals or situations that may present a risk of targeted violence.
Unlike traditional workplace security measures that primarily focus on responding to incidents, BTAM emphasizes early identification, multidisciplinary collaboration, proportionate intervention, and continuous monitoring.
Organizations can incorporate BTAM principles into existing workplace violence prevention programs, human resources procedures, employee training, and incident reporting systems.
What Is Behavioral Threat Assessment and Management?
Behavioral Threat Assessment and Management is a systematic process used to evaluate concerning behaviors and determine whether an individual may be progressing toward violence.
The approach draws upon research and guidance from organizations including:
Federal Bureau of Investigation (FBI)
U.S. Secret Service National Threat Assessment Center (NTAC)
Department of Homeland Security (DHS)
Cybersecurity and Infrastructure Security Agency (CISA)
Occupational Safety and Health Administration (OSHA)
'BTAM is based on an important principle: The goal is not to predict who will become violent, but to identify concerning behaviors, evaluate their significance, and implement interventions that reduce risk.
A person expressing frustration, experiencing emotional distress, or having a disagreement with management does not automatically represent a threat. Effective assessments consider the totality of the circumstances, including observable behavior, context, intent, capability, and evidence of preparation.
Seven Steps to Implementing a Workplace BTAM Model
Step 1: Establish a Multidisciplinary Threat Assessment Team
The foundation of an effective BTAM program is a multidisciplinary team responsible for reviewing concerns, evaluating available information, and coordinating appropriate responses.
Depending on organizational size and resources, the team may include representatives from human resources, security, executive leadership, legal counsel, occupational safety, and qualified behavioral health professionals.
Law enforcement and external threat assessment specialists may be consulted when circumstances warrant additional expertise.
Key responsibilities include:
Reviewing reported threats and concerning behaviors.
Determining whether immediate protective measures are necessary.
Gathering and evaluating reliable information.
Identifying potential victims, vulnerabilities, and risk factors.
Developing appropriate intervention and safety plans.
Monitoring cases and reassessing risk when circumstances change.
Maintaining confidential documentation and establishing case closure criteria.
Smaller organizations may use a limited internal team supported by external specialists.
The objective is to combine multiple professional perspectives rather than relying exclusively on one manager's interpretation of an individual's behavior.
Step 2: Develop a Behavioral Reporting System
An effective threat assessment program depends on employees recognizing concerning behaviors and knowing how to report them.
Employers should establish accessible procedures that allow employees, supervisors, contractors, and other stakeholders to communicate concerns without fear of retaliation.
Reports should focus on observable conduct rather than assumptions about a person's personality, background, or mental health.
Examples of behaviors warranting further evaluation include:
Direct or indirect threats of physical harm.
Escalating intimidation, harassment, or stalking.
Repeated expressions of violent intent or revenge.
Unusual fixation on a particular employee or grievance.
Statements suggesting violence is necessary or justified.
Attempts to obtain unauthorized access to restricted areas.
Evidence of planning, preparation, or surveillance associated with a potential attack.
Significant changes in behavior accompanied by other credible indicators of violence.
No single behavior reliably establishes that violence will occur. The significance of a warning sign depends on its context, severity, frequency, and relationship to other available information.
Organizations should provide multiple reporting channels, such as supervisors, human resources, designated safety personnel, and confidential reporting systems.
Employees must also understand that immediate danger requires contacting emergency services rather than waiting for a routine threat assessment review.
Step 3: Apply a Structured Behavioral Assessment Framework
Once a concern is reported, the threat assessment team should initiate a fact-based review.
A useful approach is to examine whether an individual exhibits behaviors associated with a potential pathway toward targeted violence.
This pathway is a conceptual framework, not a fixed progression or a prediction tool.
Behavioral factor | Questions for assessment |
Grievance | Does the individual believe they have been wronged or unfairly treated? |
Violent ideation | Have they communicated thoughts or intentions involving violence? |
Intent | Is there evidence that the individual intends to act? |
Capability | Does the individual have the means or demonstrated ability to cause harm? |
Planning | Is there evidence of selecting targets, developing plans, or conducting surveillance? |
Preparation | Have steps been taken to acquire resources or prepare for violence? |
Escalation | Are concerning behaviors increasing in severity, frequency, or specificity? |
Protective factors | What relationships, support systems, or circumstances may reduce risk? |
An individual may display a grievance without presenting a credible threat. Conversely, a serious risk may exist even when no explicit threat has been communicated.
The assessment team should evaluate multiple sources of information and distinguish verified facts from allegations, interpretations, and speculation.
Step 4: Establish Risk-Based Response Protocols
Organizations should develop procedures that link assessment findings to appropriate protective actions.
One practical approach is to use four operational response categories. These are illustrative categories rather than a universally validated risk-scoring system.
Assessment category | Characteristics | Organizational response |
Low concern | Isolated behavior without credible indications of violent intent | Document, address workplace concerns, and reassess if new information emerges |
Moderate concern | Repeated or escalating behavior requiring additional investigation | Conduct a structured assessment, provide support, and consider targeted precautions |
High concern | Credible indicators of intent, planning, capability, or targeting | Initiate urgent specialist review, implement protective measures, and coordinate with law enforcement as appropriate |
Imminent danger | Evidence of an immediate or rapidly developing threat to safety | Contact emergency services, activate emergency procedures, and protect potential targets |
Threat levels should never be based solely on a numerical score or an employee's subjective impression.
Assessment teams must consider the interaction between behavioral evidence, available resources, potential targets, and the individual's circumstances.
Step 5: Implement Threat Management and Intervention Strategies
Identifying a potential threat is only part of the process. Organizations must develop strategies that actively reduce the possibility of violence.
Depending on the assessment, interventions may include:
Facilitated conflict resolution when appropriate and safe.
Employee assistance and behavioral health referrals.
Adjustments to supervision, scheduling, or workplace assignments.
Clearly communicated behavioral expectations and boundaries.
Restrictions on unauthorized workplace access.
Increased security precautions for specifically identified risks.
Coordination with law enforcement and qualified threat management professionals.
Protection and support for employees experiencing threats or intimidation.
Interventions should be individualized, lawful, proportionate, and regularly reviewed.
A critical consideration is that poorly planned disciplinary action, termination, or confrontation may create additional safety concerns in certain cases. When credible threats are present, the organization should evaluate protective measures before implementing potentially destabilizing employment decisions.
The objective is not simply to discipline an individual. It is to interrupt a potentially dangerous behavioral trajectory while protecting employees and addressing contributing circumstances whenever possible.
Step 6: Integrate BTAM Into Workplace Training
A behavioral threat assessment program cannot function effectively if employees do not recognize warning signs or understand their reporting responsibilities.
Training should be tailored to the employee's role.
Frontline employees should learn to recognize concerning behaviors, manage immediate interactions safely, establish boundaries, disengage when necessary, and report observations accurately.
Supervisors and managers should receive additional instruction on documenting concerns, handling grievances, responding to threatening behavior, and escalating reports without making unsupported conclusions.
Threat assessment team members require specialized training in structured professional judgment, information collection, behavioral assessment, confidentiality, intervention planning, and case management.
The Center for Violence Prevention and Self Defense (CVPSD) emphasizes the integration of situational awareness, emotional self-regulation, verbal de-escalation, behavioral recognition, and practical workplace safety procedures.
These skills can strengthen the early identification and reporting components of a BTAM program.
However, general workplace violence prevention training does not replace the specialized qualifications and expertise needed to conduct complex behavioral threat assessments.
Step 7: Monitor, Document, and Continuously Improve
Threat assessment is not a one-time decision. Risk may increase, decrease, or change as circumstances develop.
Organizations should implement case management procedures that document:
Initial reports and supporting information.
The assessment team's factual findings and rationale.
Protective measures and intervention decisions.
Individuals responsible for follow-up activities.
Changes in behavior or circumstances.
Scheduled reassessment dates.
Criteria for modifying or closing a case.
Documentation should be securely maintained, with access restricted to authorized personnel and retention governed by applicable law and organizational policy.
Organizations should also evaluate the overall effectiveness of their BTAM programs by reviewing measures such as reporting participation, response timeliness, staff training completion, implementation of safety measures, and completion of follow-up activities.
An increase in reporting should not automatically be interpreted as an increase in violence. It may instead indicate improved employee awareness and confidence in the reporting process.
Example: Applying BTAM to a Workplace Situation
Consider a hypothetical employee who has experienced a series of workplace disputes and recently received disciplinary action.
Following the disciplinary action, the employee begins making statements about retaliation, repeatedly contacts a particular supervisor, and communicates increasingly specific grievances.
A coworker reports these observations through the organization's workplace violence reporting system.
Without a structured BTAM process, management might dismiss the behavior as ordinary frustration or respond with immediate disciplinary action without evaluating the potential safety implications.
With an established BTAM process, the organization can take a coordinated approach:
Identify: A coworker reports the concerning statements and behaviors.
Assess: The threat assessment team reviews the report, interviews appropriate parties, and evaluates credible behavioral evidence.
Determine risk: The team considers the nature of the grievance, specificity of threats, evidence of intent, capability, escalation, and protective factors.
Intervene: Appropriate personnel develop a safety and support plan proportionate to the findings.
Monitor: The organization tracks relevant developments and adjusts its response if new information becomes available.
This approach allows the employer to consider employee safety, procedural fairness, and the individual's circumstances before determining the appropriate response.
Common Mistakes Organizations Should Avoid
Even well-intentioned organizations can undermine threat assessment programs through inconsistent implementation.
Common mistakes include treating every workplace conflict as a violent threat, relying exclusively on subjective observations, failing to document escalating behaviors, or allowing reports to remain unresolved.
Another significant mistake is treating mental illness, disability, personality differences, or protected characteristics as evidence of dangerousness. A proper assessment evaluates behaviors and relevant circumstances, not stereotypes or diagnostic labels.
Organizations must also avoid using threat assessment procedures as a substitute for legitimate employee grievance processes or as a mechanism for retaliation.
A credible BTAM program requires clear safeguards for privacy, nondiscrimination, lawful information sharing, employee rights, and objective decision-making.
Integrating BTAM With a Comprehensive Workplace Violence Prevention Program
Behavioral Threat Assessment and Management should operate as one component of a broader workplace violence prevention strategy.
While BTAM focuses heavily on identifying and managing potential targeted violence, comprehensive prevention programs also address spontaneous aggression, customer and patient violence, domestic violence affecting the workplace, environmental hazards, and emergency response.
Employers should integrate BTAM procedures with existing workplace violence prevention policies, employee reporting systems, security measures, and training requirements.
Requirements vary by industry and jurisdiction. For example, certain states have enacted specific workplace violence prevention requirements that may impose additional responsibilities concerning written plans, reporting, training, and recordkeeping.
A BTAM program should complement these obligations rather than be treated as a substitute for regulatory compliance.
Conclusion: Moving From Reactive Security to Proactive Prevention
Effective workplace violence prevention requires more than security cameras, emergency response plans, or policies prohibiting threatening behavior.
Organizations must develop the ability to recognize concerning behavioral patterns, evaluate risks objectively, communicate across departments, and intervene before circumstances escalate.
Behavioral Threat Assessment and Management provides a structured method for accomplishing these objectives.
By establishing multidisciplinary teams, implementing accessible reporting procedures, applying evidence-informed assessment practices, and maintaining ongoing case management, employers can strengthen their capacity to prevent targeted violence.
The central objective is not to identify dangerous people based on appearances or assumptions. It is to recognize concerning behaviors, understand their context, and take appropriate action before preventable harm occurs.
For organizations seeking to strengthen their prevention capabilities, CVPSD provides training in situational awareness, behavioral recognition, conflict management, verbal de-escalation, and workplace violence prevention. These practical skills can support the broader implementation of an organization's behavioral threat assessment and management program.
About the Author: William DeMuth is the Director of Training at the Center for Violence Prevention and Self Defense (CVPSD) in Freehold, NJ. With over 35 years of research in violence dynamics and personal safety, William specializes in evidence-based training that bridges the gap between compliance and real-world conflict resolution. The architect of the Conflict Intelligence program, he holds advanced certifications and has trained under diverse industry leaders. Today, he actively trains civilians, healthcare workers, and corporate teams in situational awareness, threat assessment, behavior analysis, de-escalation strategies, and physical tactics.
References and Professional Resources
Federal Bureau of Investigation (FBI). Making Prevention a Reality: Identifying, Assessing, and Managing the Threat of Targeted Attacks. FBI Threat Assessment Guide.
U.S. Secret Service, National Threat Assessment Center (NTAC). Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence. 2024. NTAC Guide.
Federal Bureau of Investigation and American Hospital Association. Implementing Behavioral Threat Assessment and Management. 2026. BTAM Implementation Resources.
Cybersecurity and Infrastructure Security Agency (CISA). Violence in the Federal Workplace: A Guide for Prevention and Response. CISA Workplace Violence Resources.
Occupational Safety and Health Administration (OSHA). Workplace Violence: Overview and Prevention Resources. OSHA Workplace Violence.
U.S. Department of Labor. Workplace Violence Program. DOL Workplace Violence Policy.
Center for Violence Prevention and Self Defense (CVPSD). Workplace Threat Assessment Guide for HR and Safety Leaders. CVPSD Threat Assessment Resource.
