Behavioral threat assessment and management (BTAM) is a team-based process for spotting concerning behavior early, assessing how much risk it carries, and stepping in before it turns into violence. An effective BTAM program rests on 10 building blocks: leadership policy, a multidisciplinary team, centralized reporting, structured intake, a defined assessment process, evidence-based frameworks, active case management, outside partnerships, ongoing training, and continuous evaluation.
Here’s the thing. Violence is preventable. You can’t predict exactly who will turn violent, and nobody can promise you a clean sweep. But you can prevent a lot of it. The FBI’s 2018 study of active shooters said it plainly: predicting violence may be impossible, but preventing some attacks through threat assessment is not. That same study found the average active shooter went through 3.6 separate stressors in the year before attacking and showed four to five concerning behaviors that people around them could see. The idea that someone just snaps is a myth. There’s almost always a trail.
BTAM is how you pick up that trail. It’s a de-escalatory, non-punitive capability. The goal is to reach someone early, often someone in crisis, and get them the support and the off-ramp they need before violence ever looks like a solution.
Here are the 10 building blocks that make it work.
1. Leadership commitment and written policy
Every BTAM program starts at the top. Senior leaders put it in writing that violence prevention is a core safety value. They name the behaviors the organization won’t tolerate, and they give the threat assessment team real authority to act. Skip this step, and you’re left with well-meaning people who can’t actually do anything. Policy is what turns good intentions into a mandate.
2. A multidisciplinary BTAM team
BTAM is a team sport. No one person should manage threats alone, because no one person sees the whole picture. You blend HR, security, legal, mental health, and line management, and you bring in law enforcement when a case calls for it. Run every threat through one lens, security alone or HR alone, and you’ll mishandle it. The team exists so no single lens runs the show.
3. Centralized reporting and bystander engagement
Early reporting saves lives. Give people one clear, simple way to raise a concern: a 24/7 hotline, a web form, or an app. Then teach them what’s worth reporting. See something, say something. Anonymous reports are fine, and you want them. Named reports are more useful, because they let you follow up and move faster.
4. Structured intake and documentation
Consistent records matter. Use one standard intake form every time. Capture who reported, who’s involved, what happened, and the context around it. Clean documentation is what makes your decisions defensible later. In this work, if it isn’t written down, it didn’t happen.
5. A defined assessment process
Think of BTAM as a loop, not a line. You identify the concerning behavior, inquire by gathering facts, assess the level of risk, and manage the situation with a clear intervention. It isn’t one and done. As new facts come in, you move back through the phases and adjust. The loop is what lets the program keep up with a situation that’s still changing.
6. Evidence-based assessment frameworks
Good assessments rely on research, not gut feel. You’re looking for studied warning signs: motive, planning, leakage, stressors, and protective factors. Leakage is when someone signals their intent to a third party before acting. Protective factors are the things that pull a person back from the edge. Structured tools like the WAVR-21, a 21-item instrument built by Drs. Stephen White and Reid Meloy for workplace and campus violence risk, keep your assessments consistent from one case to the next. That consistency is also what holds up when a decision gets questioned later.
7. Active case management and intervention
Assessment identifies risk. Management is what saves lives. Your options run wide: an employee assistance program, added security, a change in duties, or legal action when it’s warranted. Match the intervention to the person in front of you. Document what you did, and revisit the case on a schedule, because people change and so does the risk they carry.
8. Partnership with outside agencies
Build the relationships before you need them. Connect with local law enforcement, mental health services, and community resources long before an incident. Pre-planned agreements are what let you share information fast in the moment, when time is the one thing you don’t have.
9. Training, communication, and culture
BTAM only works if people understand it. Training isn’t a one-time rollout. Regular sessions, tabletop exercises, and scenario drills build a workplace where people feel safe speaking up early. That culture, where raising a concern is normal instead of awkward, is what the whole program depends on.
10. Continuous evaluation of the BTAM Program
Measure what matters. Track the number of reports, your response times, and how your interventions actually turned out. Hold the program against benchmarks, update your policies, and adjust the process based on what the real world tells you. A program nobody reviews slowly drifts out of date.
The whole system
Put these together and you’ve built a safety net. It catches early warning signs, routes people toward the help they need, and protects your workplace long before violence occurs. None of it asks you to predict the future. It asks for a system, a trained team, and the willingness to act early.
If your organization has three or four of these in place, that’s not a failure. It’s a starting line. Building out the rest is the work we do with organizations every day, and it starts with a single reported concern taken seriously.
Learn more about our BTAM offerings here.
Want more? Read the Six Questions to Ask Yourself About Security Risk Assessments from the Security Executive Council.
