Workplace Standards for "Active Shooter" Prevention and Response

Recently, ASIS International (an international organization for security professionals) and NFPA (National Fire Prevention Association) teamed up to talk about writing a standard for "active shooter" prevention and response in the workplace. You can read the notes of their January 19, 2016 meeting online here:

In their statistical analysis, they do note that 13.1% of active killers are successfully stopped by unarmed citizens and 3.1% are stopped by armed citizens, however, the role of the armed citizen is conspicuously missing in their threat assessment and response brainstorming session. Generally speaking, ASIS seems to have a history of being opposed to licensed citizens carrying concealed in the workplace, or even having a firearm secured in their own vehicle on their employer’s premises. Based on this, it is safe to assume that any “workplace safety” standards they are involved in writing, will more than likely include statements about prohibiting weapons on company premises.

The difficulty here is that when recognized professional organizations like NFPA write a standard, those standards can be “incorporated by reference” in the OSHA standards. Basically, OSHA can choose to adopt 3rd party guidance as "consensus standards.” Consensus standards are typically written by organizations like ANSI, ASTM, NFPA, and other private organizations you’ve never heard of like The Compressed Gas Association, The Chlorine Institute, and others. These standards can be enforced on businesses with the same force and effect as other OSHA regulations, through a section of law called 5(a)1, affectionately referred to as the “General Duty Clause.” The General Duty Clause basically states that employers “must provide a workplace free of recognized hazards.” This is what OSHA uses to issue citations to an employer if they aren’t breaking any specific OSHA workplace safety standard, but they: A. don’t like what you are doing, or B. feel like shaking you down anyway. This is lucrative business for OSHA, an agency funded, at least partially, by the fines it levies against U.S. employers. Under the Obama Administration, the amount of OSHA fines has almost doubled, with “Serious” citations costing up to $12,000 each, and “Repeat” or “Willful” citations being 10 times that amount.

If you are fortunate enough to have an employer who permits licensed individuals to carry concealed on company property, all it would take is for OSHA to “incorporate by reference” an ASIS/NFPA “active shooter” standard that requires employers to prohibit firearms on company property, and it could begin to enforce it and levy fines on employers who don’t enforce strict anti-gun policies in the workplace.

It is also important to remember that laws, policies, and signs don’t stop mass murderers, there is ample proof of that. The individual who has reached the conclusion to take such an action, has planned the attack, gathered the tools of destruction, and set the plan in motion, will only stop when they are good and ready to stop, or when someone else actively stops them. Plans such as the ALICE program, or the ubiquitous “Run, Hide, Fight” method that have gained popularity do discuss "stopping" the active killer. These programs have been advocated in the most risk-averse, zero-tolerance-for-violence workplaces, even though both plans advocate resistance or fighting as a last resort. What many supposedly non-violent administrators and policy makers fail to realize is that throwing a soup can at a shooter, mobbing a shooter, even spraying them with wasp spray (which we know doesn’t work), are all forms of “violence,” just not as effective as firearms, (or even real chemical irritants like pepper spray) against an attacker armed with a firearm. This places the defenders at an even greater disadvantage.


Recently, my own company consulted with a third party security firm regarding workplace security training. After reviewing their training materials, I was less than impressed. Not only did I consider the material out of date, it seemed more like a general guide for risk-averse employers to put a basic written plan together for an event they never realistically expected to occur. It didn’t address reasonable responses to violent behavior, there was nothing about setting verbal barriers to inappropriate behavior, and it drew no distinction between two guys talking about a weekend hunting trip, and someone planning a workplace shooting. More disturbingly, it seemed to tell everyone to be afraid of everyone else's reasonable emotional reactions to the modern workplace. Let’s face it, voices will occasionally be raised, profanities will occasionally be uttered, and people will be angry with each other - this is normal, natural, and to a certain extent unavoidable, not always a precursor to murder.


Employers are responsible for having policies covering essentially everything that takes place on company premises. There can be hundreds of policies addressing specific procedures and behaviors, but anything they don't want to deal with in depth usually goes in "the list." Somewhere, every employer has a basic list of workplace "thou shalt not" rules that they can fall back on when all else fails. "The list" usually consists of a number of "because I said so" prohibitions on undesirable workplace behaviors such as horseplay, fighting, theft, and almost universally, words to the effect of: "no weapons are allowed on company property." This is an artifact of pre-OSHA and days when businesses didn't have to have shelves full of written management programs, justified by code and best practices, addressing everything in excruciating detail. For those employers who do wish to allow licensed individuals to carry concealed on their property (or for those employees trying to convince their employers), I have some suggestions on what type of items you might consider putting in your plans to deal with concealed carry and workplace violence in a more enlightened manner.

  • The Risk Assessment:

"It doesn't matter how you get there, if you don't know where you're going." You can't develop a proper defensive strategy unless you spend some time studying the types of situations you may need to defend against. This is a typical brainstorming session where any conceivable threat should be added to the list. Once you have a list of threats, then you evaluate each one by "frequency" (how often is it likely for such an event to occur?) and "severity" (what are the potential consequences of the event). Usually, each category is scored from 0 to 4, with 0 being essentially impossible/negligible consequences, 1 being less likely/minor consequences and 4 being very likely/catastrophic consequences. Let's look at 3 examples:

Example 1.) There haven't been any volcanoes in Ohio since the Ordovician period, roughly 450 million years ago, and Ohio was on the equator at the time. We can safely score the "frequency" of a volcanic event as a solid 0. Now, the consequences of a volcanic eruption in Ohio could be catastrophic, score it a 4, but since 0 X 4 = 0, it is not reasonable to consider volcanoes a risk that we should prepare for in Ohio. Now, if you live in Hawaii or the Pacific Northwest... maybe that frequency number for volcanoes scores a little higher for you.

Example 2.) A simple act of vandalism may have a frequency of 3, it is fairly likely that such an event will occur at some point. The severity of a simple act of vandalism would be a 1, however, because someone painting graffiti on your facility wall isn't likely to cause employee injury or business interruption, 1 X 3 = 3. It is reasonably likely, just not significant enough to justify extraordinary efforts at prevention.

Example 3.) Let's contrast these with the risk of someone going on a killing rampage in the workplace. Statistically speaking, these events are still uncommon, so depending on the workplace, you might score the frequency at a 1 or 2. The severity, on the other hand, is considered catastrophic, so that would be scored a 4. Calculating the risk yields 2 X 4 = 8. That possibly deserves more attention.

Once we generate all those numbers, it is up to the company to decide what amount of risk they are comfortable accepting. A company may say any risk category of 3 or below doesn't deserve any particular attention, while risk categories of 4 to 8 will require a written policy, employee awareness training, and perhaps some security features such as emergency lighting, security cameras, and basic facility access control. More severe risk categories, scoring 9 or hire perhaps, might require more active preventive measures like security guards. Again, it is up to facility management (smart managers will also seek employee input), to determine what level of risk they are willing to accept and prepare accordingly.

  • An Ounce of Prevention:

Once we have brainstormed and scored the risks, we formulate a layered strategy to protect the workplace. This could include everything from employee background checks during your hiring process to passive security measures like fences and cameras, to active security measures like security awareness training for employees or even hiring a professional security service. Keep in mind that preventive measures may not completely eliminate the risk, nor do they need to, they just need to reduce the residual risk to an "acceptable" level. These security measures should be documented in a confidential workplace security plan so the employer has a written management strategy to keep things on track, as well as a way to demonstrate a commitment to employee safety and security to the Secretary of Labor (or his representatives) should OSHA ever come knocking. Be careful how this information is maintained and distributed, in the wrong hands it is a blueprint for maximum casualties.

  • Hope for the Best, Prepare for the Worst:

In addition to a security plan, every organization needs an emergency response plan detailing immediate actions to take in the event of all "reasonably foreseeable" emergency situations - from severe weather, to employee injuries, to workplace violence. Any items that have high enough residual risk (however management defines that) on the initial risk assessment should be included in the emergency response plan. Managing that residual risk should involve a logical, realistic approach. Companies are pretty good at this when it comes to things like fires and tornadoes, but they don't do so well when it comes to violent behavior. I recently read an "active shooter" plan published by a large university that advocated "running in a zig zag pattern," as well as the admonition to "take cover under desks" and a prohibition on attempting to resist violent individuals. The Columbine Massacre spectacularly taught us that hiding under desks during a murder rampage is the ultimate in wishful thinking. Such recommendations are the ravings of individuals who put more faith in their job titles than in the research and findings of experts who have studied what will realistically improve survival in these situations. Threats like fire, chemical releases, and severe weather are not sentient threats, they are indiscriminate forces that affect areas where conditions enable them to. A spree killer, on the other hand, may be crazy, but probably has a goal and may be perfectly capable of rational decisions and decisive actions to achieve that goal. We all get programmed in early school how to stop, drop, and roll; how to orderly evacuate a building, or how to hunker down in a tornado shelter. Almost everyone also understands that not every canned response is suitable for every emergency. No half-way intelligent person would suggest students hide under desks in a burning classroom, or that someone should run out of a building during a violent storm, would they? Consequently, we should realize by now that applying the same response methodologies that one would use for an indiscriminate threat, to a motivated, rational (if insane) person, is only likely to increase the casualties or at least complicate rescue efforts.

So how should a company address this type of threat in their emergency action plan? First, we have to do away with "zero tolerance" policies that protect and empower the bullies, and turn everyone else into victims. Let's restore some good sense. Violence encompasses a whole spectrum of behaviors, but when it comes to physical violence, employees should be permitted or even encouraged to take reasonable action to protect themselves. Such a statement could sound like: "...employees may take action to defend themselves if assaulted, but only to the extent absolutely necessary to escape the situation. Employees are required to make every effort to de-escalate confrontational situations. Depending on the circumstances, one or all of the involved parties may be subject to disciplinary action." That sends a very clear message, that your employer doesn't want you to fight, and there will be consequences for fighting, but the workplace bullies aren't going to get away with tormenting people either. If you get physical with someone, they might just get physical back ...only in order to escape the situation, of course. When it comes to more severe forms of violence like an individual brandishing a lethal weapon (gun or knife), or even assaulting people with it, the individual really only has 3 valid response options: you can try to get away, you can try to shelter in place, or you can try to actively resist. In other words...we are back to "Run, Hide, Fight." There really aren't any other options, your only possible responses are some variation or combination of these. Of course we could talk about the human stress response and get into freeze, posture, and submit, but submitting is not generally considered an appropriate response during this type of event, posturing is a form of resistance or fighting, and freezing is just a primitive pre-programmed subroutine that is, in fact, a form of hiding. Advocating the appropriate actions in the form of a policy is difficult, but one may try something along the lines of:

"1. ESCAPE- Individuals should get away from the scene as quickly as possible. Large, open areas or places with only one means of escape should be avoided. Escaping individuals should get away from the facility to a place of cover and/or concealment. Tactics such as "running in a zig zag" are not advised, as these may not be effective. Running quickly and directly to positions of cover or concealment are more effective. Employees are not to run to their cars or gather in a group in a parking lot or other open areas. If it is safe to do so, employees should assist injured individuals to escape the situation. Once reaching a safe area, individuals should call 911, report the situation as well as their location and condition. Due to the large amount of calls received during these types of events, it is possible that the line will be busy. Individuals should take whatever first aid steps they can to control bleeding and treat other injuries until emergency responders arrive."

I need to point out a few things, first, the phrase "if it is safe to do so," is used in a number of emergency response actions from putting out incipient stage fires with fire extinguishers, to rendering first aid in a potentially hazardous environment. This should be explained that employees are not to put themselves in danger to save others if there is an imminent risk, just like you wouldn't want an employee entering a confined space to perform a rescue without proper training and equipment. That said, there are situations when employees can assist others in a way that doesn't expose them to additional danger, and will save lives. This is still a personal choice for the employee, not an expectation of their job. Second, employees are told not to congregate in groups in the parking lot or other areas. As killers get more creative, the possibility of bombs or other hazardous devices placed in likely evacuation areas needs to be considered, as does the threat of a second shooter with a scoped rifle looking for easy targets at a pre-determined gathering place.

2.HIDE- Individuals who can not escape from the scene should find a hiding spot. Obvious hiding areas like under desks or in closets should be avoided, as should areas that do not offer a secondary means of escape. Once it becomes safe to move, individuals should leave the hiding spot and get away from the facility. Hiding in plain sight by "playing dead" is not advised unless there is no other option. If it is safe to do so, employees in hiding should call 911 and report the situation as well as their location and condition. Due to the large amount of calls received during these types of events, it is possible that the line will be busy. Individuals should take whatever first aid steps they can to control bleeding and treat other injuries until emergency responders arrive.

The only thing I want to add to this is that tourniquets save lives.

3.RESIST- If an individual can not escape or hide and their life is in danger, they should resist the attacker by fighting with whatever can be used as a weapon.

Once responding officers arrive, employees are required to cooperate fully with their instructions and are to keep their hands in plain view until instructed otherwise."

This is fairly standard policy language, and those aren't necessarily steps given in order. In the midst of the emergency, employees will have to play the hand they are dealt. The employee who rounds a corner and comes nose to nose with an shotgun muzzle shouldn't think about hiding or running anymore at that point. If they want to survive, they might be better served channeling that huge dose of adrenaline into the most aggressive and violent outburst they can muster. That's still no guarantee, but it's a better way to go than cowering under a desk, and statistically offers the best chance of survival. The problem with this is still we are sending an unarmed person up against an armed person. There is an old adage often attributed to Clint Smith, President of Thunder Ranch: "An armed man will kill an unarmed man with monotonous regularity." Maybe, maybe not.

Many employers have concerns regarding liability and effects on insurance if they allow employees to carry concealed firearms. This is more of a lazy excuse than a legitimate concern, as I have had discussions with multiple insurance agents for businesses and they pretty much all state that as long as the business is following the state law, it doesn't affect the plan or the rates. Here in Ohio, the law specifically states: "A private employer shall be immune from liability in a civil action for any injury, death, or loss to person or property that allegedly was caused by or related to a licensee bringing a handgun onto the premises or property of the private employer, including motor vehicles owned by the private employer, unless the private employer acted with malicious purpose. A private employer is immune from liability in a civil action for any injury, death, or loss to person or property that allegedly was caused by or related to the private employer's decision to permit a licensee to bring, or prohibit a licensee from bringing, a handgun onto the premises or property of the private employer. As used in this division, "private employer" includes a private college, university, or other institution of higher education." So the employer is protected from legal action in either case, unless the prosecution can prove the employer acted with malicious purpose.

That said, if we were to write a workplace health and safety policy regarding concealed carry, I would suggest the following:

"1. Carrying of concealed firearms is limited to state-licensed individuals and only in areas where firearms would not present unacceptable hazards due to other safety requirements."

Some areas in facilities, due to the presence of strong magnetic fields, flammable gases and vapors, or combustible dusts, just wouldn't work with concealed handguns. A negligent discharge from sloppy holstering in an office building will result in some ears ringing, maybe the armed individual being injured, but that probably isn't going to lead to the entire facility exploding and killing everyone inside. That same negligent discharge in an environment with a combustible atmosphere is a different story. Food and pharmaceutical processing facilities governed by FDA regulations may not be the best place for handguns either.

2. Handguns must be carried concealed (no open carry).

Let's face it, some people are offended or intimidated by the very sight of a firearm. Ideally, no one should know who is carrying guns and who isn't.

3. Handguns must be carried in a holster that fully covers the trigger guard on the person or holstered in a purse, backpack or something similar and be attended at all times unless secured in a DOJ-approved locking case or box and in a locked office or vehicle.

4. Firearms must remain cased or holstered at all times except when use of force would be reasonable and lawful or when removing the firearm to secure it in a locked case or box or transferring it from such a box to a holster.

5. Licensed personnel who wish to carry must provide their own DOJ-approved locking case or box to secure the firearm when necessary to leave the firearm unattended (in a locked office or vehicle).

I'm not a fan of off-body carry, but depending on the type of job you have and the type of workplace you are in, it is conceivable that you have to take your gun off at some point. Keeping that firearm secure is still your responsibility.

"too much for liberty, not enough for competency."

While it might be tempting for employers to have additional qualification or training requirements for concealed carry, I would advise against such stipulations. As concealed carry in this context is a non-work related activity, the addition of burdens above and beyond what the state law requires could be construed as an endorsement or recommendation, which I would think companies would want to avoid. That said, most state's basic concealed carry training requirements are woefully inadequate in my opinion. I am fond of saying such training requirements are: "too much for liberty, not enough for competency." As "constitutional carry" (the Right for law-abiding citizens to carry concealed firearms without a state-issued license) becomes more popular, individuals with no formal training whatsoever will have the right to carry concealed firearms in public. Because of this general lack or inadequacy of formal training, some basic awareness training on the workplace rules and policies governing concealed carry and a blanket recommendation to seek additional and ongoing training would be recommended.

These rules as stated take on no extra responsibilities for the company, cost the company nothing, and add no additional legal or liability burden.


John Adams stated: "Facts are stubborn things; and whatever may be our wishes, our inclinations, or the dictates of our passions, they cannot alter the state of facts and evidence." Alas, facts and evidence may always return to bite us, but wishes, inclinations, and the dictates of passions seems to be more persistent still these days, particularly when it comes to controversial topics. People give credence to the emotional opinions generated by their limbic system, programmed by the unreality of television or their own ego and imagination, which they then call "common sense," and attempt to apply to the real world. Workplace safety and security is not always intuitive, and definitely not “common sense.” It has to be based on statistical and anecdotal evidence, tailored to the specific workplace and workforce, and then implemented with plenty of training and consistency. This often takes the hand of a skilled professional. Sadly, most employers will look no further than the guidance of their local employer’s association, ironically thinking that the same risk-averse plans that have failed time and again are a “safe bet.”