Security Audit – How Vulnerable Is Your Organization?

Often rules and guidelines for human services organizations are based on events and the realization that if xyz law was in place, the event could have been avoided.  Just look at Tarasoff v. Regents of University of California and how mandated reporting was forever changed. Risk management is an important area of a human services organization, and involves balancing the needs of those served, the community and those who work there. This post is the first in a two part series that focuses on workplace violence, how to reduce risk and protect not only your organization and the people, but the community at large. These were originally posted last year however they deserve another look. Think of this as a reminder to us all; a booster shot of protection.

A Story of Caution

You may never imagine your organization as the target of a civil lawsuit or the target of violence – but what if? How would your organization bear up under scrutiny? Imagine that your employer is being sued after a horrible shooting where a recently disciplined employee returns to kill a supervisor, another employee and then themselves.

An eager young plaintiff attorney with ridiculous student loans has done their due diligence in collecting any evidence of negligence. First they will look at your workplace violence policy.  You know, the one that was written in 1992 and is only about 500 words that basically entails telling employees not to threaten or assault anyone and prohibits any weapons in the workplace.  The attorney requested any information about how this policy was disseminated to employees and what training was provided to help employees recognize the threat, mitigate any problems and report their concerns.  They ask for things like a signed acknowledgement of reading the policy and agreed to the terms or the training attendance roster.

The Employee Perspective

When the human resources department isn’t able to provide these items, the plaintiff team goes ahead and gathers testimony from the surviving employees.  They not only ask questions about the employees’ knowledge of the policy and procedures, but also about how they would actually handle concerns and whether there were any examples. Unfortunately, your organization has plenty. Although the security department provided the 12 incident reports gathered from the past 5 years, the fact-finding mission turned up 23 stories of cases where a threat was made or some incident occurred. These substantiated tales were told around the break room but never documented in any report.  Worse, it was easy to get the employee’s enthusiastic support, because there is a general resentment towards management for their apparent lack of response to employee safety concerns.  Tragically, the recent shooting was met with a bitter “I told you so.”

The Evidence

Though these anecdotes are subject to perspective and alteration through time, the inquiry then turns to hard evidence.  They took pictures and videos of back doors that don’t latch properly, access control security equipment that no longer work, and even overgrown bushes edging the parking lot that are perfect places for an assailant to hide. But all of this research covers the general preparedness of the organization.  The center point of the lawsuit focuses on the negligence in responding to the pending threat.  Who knew and when? For the half-dozen staff that were concerned, what happened when one person finally did talk to a supervisor about the assailant’s erratic behavior (this is where the attorney started thinking about a beach house)? The only record of the threat being addressed was a handful of emails and a description of a 10-minute meeting inquiring about anger management classes. There was an email sent to the contracted Employee Assistance Program but while the team were waiting for a reply, the gunman arrived on the grounds.

Preparedness

It’s pretty clear by now that your company was not capable of preventing this incident.  If that was not bad enough, the attorney starts investigating your Emergency Management preparedness, designed not to stop the event from occurring but to mitigate its impact.  Preparedness includes things like mass notification, trauma support, and business continuity.   What the attorney found — or more accurately, what they did not find — now has them thinking about expanding their office. How would you fare facing this attorney in court?  Regardless, the attorney would be a breeze compared to the funeral where you will be facing the family of the murdered victim. Being prepared means that you care.
Editor’s Note: This post was originally published in May 2016 and has been updated with new content.