From Assessment to Action: How to Build a Behavioral Threat Management Plan That People Can Actually Implement
Updated: 4 days ago
DOWNLOAD THE GUIDE HERE
In a previous *Safety Brief*, I made the argument that assessment is only the beginning of Behavioral Threat Assessment and Management (BTAM).
Identifying the nature and level of concern matters. Gathering good information matters. Understanding what may be driving concerning behavior matters. But prevention ultimately depends on what the team does with that information.
That raises a much more practical question:
What does a good behavioral threat management plan actually look like?
It is easy to write recommendations such as: Refer for counseling.Increase supervision. Contact parents. Continue to monitor. Those recommendations may all be appropriate. But by themselves, they are not really a management plan. Who makes the counseling referral? What specifically are we asking counseling to help address? What does increased supervision actually mean?
Who is responsible for it? When does it begin? What exactly are we monitoring? What would tell us the situation is improving? What would cause the team to immediately reassess? How long does management continue? And how will the team know when it is appropriate to reduce or eventually close threat-specific management? Those are the questions that turn an assessment into action.
Current guidance from the U.S. Secret Service's National Threat Assessment Center (NTAC) reinforces this distinction. NTAC describes BTAM as a proactive, preventive, supportive process that not only identifies and assesses concerning behavior but also provides appropriate interventions and resources. More broadly, NTAC describes behavioral threat assessment as a systematic risk-management approach that develops proactive management strategies to reduce the likelihood of violence.
For school and district teams, the takeaway is straightforward:
The assessment should identify what concerns us. The management plan should explain what we are going to do about it.
And that plan needs to be specific enough that people can actually implement it.
Start With the Assessment---But Don't Repeat It
A management plan should grow directly from the assessment. That does not mean copying every piece of information gathered during the assessment into another document. Instead, the team should ask:
Based on everything we learned, what are the most important things we now need to change, reduce, interrupt, support, or monitor?
I refer to these as priority concerns. Consider a hypothetical high school student named Jordan. The team has completed a comprehensive assessment and learned that:
Jordan has developed a significant grievance toward several peers following ongoing conflict and perceived humiliation.
His language about the peers has become increasingly retaliatory.
He has withdrawn from friends and recently stopped participating in athletics.
School performance and attendance have deteriorated.
Recent online behavior includes research related to previous acts of targeted violence.
There is currently no evidence that Jordan has acquired a weapon or developed a specific attack plan.
His parents are cooperative but were unaware of several school-based behaviors.
There is a lot of information there. But a management plan becomes much more useful if the team distills it into several priority concerns.
Priority Concern #1: Escalating grievance
Jordan continues to perceive several peers as responsible for significant humiliation and increasingly describes retaliation as justified.
Priority Concern #2: Loss of positive connections
Jordan has withdrawn from friends, stopped participating in athletics, and has fewer meaningful connections with adults and peers.
Priority Concern #3: Movement toward violent problem-solving
Jordan's online behavior and communications suggest an increasing interest in violence as a potential response to his grievance.
Priority Concern #4: Family-school information gap
Jordan's parents are willing to help but lack important information about his behavior and circumstances at school. Now the team has something actionable. Instead of asking:
"What services can we give Jordan?"
It can ask:
"What can we do that might reduce each of these concerns?"
That is a very different management conversation.
An Eight-Part Framework for Threat Management
A practical management plan does not need to be complicated. But for each case, I believe it should answer eight questions:
1. Priority Concern --- What are we trying to change, reduce, interrupt, support, or monitor?
2. Action --- What are we going to do about it?
3. Responsible Party --- Who owns the action?
4. Timeline --- When will it happen?
5. Monitoring Indicators --- What will tell us whether things are improving, staying the same, or getting worse?
6. Documentation --- How will we record implementation and changes over time?
7. Reassessment Triggers --- What would cause us to reconvene before the next scheduled review?
8. Step-Down and Closure Criteria --- What evidence would justify reducing management or eventually closing the case?
Those eight components transform recommendations into an operational plan. Let's work through them.
1. Define the Priority Concerns
One of the biggest improvements a team can make is to resist immediately jumping from assessment to intervention. First ask:
What exactly are we trying to manage?
Avoid vague descriptions such as: Student is high risk. Or: Student has anger issues. Neither statement gives the team much direction. Compare that with:
Priority Concern: Jordan's grievance toward three peers remains unresolved and appears to be intensifying. He increasingly describes their behavior as intentional humiliation and has made statements suggesting retaliation would be justified. Now the team has something it can attempt to influence. The same applies to isolation:
Priority Concern: Jordan has withdrawn from previously important peer and adult relationships and has stopped participating in an extracurricular activity that previously provided connection and structure.
The clearer the concern, the easier it becomes to identify meaningful interventions.
This is also consistent with NTAC's broader approach: threat assessment should focus on the concerning factors that appear to be driving a person toward violence, rather than attempting to predict who will become violent. (United States Secret Service)
A practical test
For every priority concern, ask:
"What are we doing about this?"
Then reverse the question. For every intervention in the plan, ask:
"Which priority concern is this intended to address?"
That creates a simple but powerful rule:
If an intervention cannot be connected to a priority concern, ask why it is in the management plan. If a priority concern has no corresponding action, ask what the team is actually doing to manage it.
2. Match Actions to the Concerns
Once the team understands the priority concerns, it can identify interventions. This is where the multidisciplinary nature of BTAM becomes particularly important. A counselor may identify opportunities for therapeutic support. An administrator may be able to address a school-based conflict or modify an environmental issue.
A teacher or coach may represent an important connection. Parents may provide information and supervision outside school. Law enforcement may have information relevant to community behavior or weapons access. Special education personnel may help ensure interventions appropriately account for disability-related needs. The management plan should bring those pieces together.
For Jordan's grievance, actions might include:
Regular check-ins with a trusted adult.
Counseling focused on coping, problem-solving, and grievance resolution.
Appropriate intervention into substantiated bullying or peer conflict.
Reducing unnecessary contact with particular peers when appropriate.
Clear behavioral boundaries regarding threatening or intimidating communication.
For Jordan's loss of connection:
Re-engagement with his coach.
Identification of another trusted adult.
Support for returning to a valued activity.
Intentional opportunities for positive peer connection.
For the family-school information gap:
A designated school-family contact.
Scheduled communication.
Clear expectations about what behavioral changes should be shared immediately.
This produces something much stronger than: Refer to counseling. Counseling may be important, but it is one component of a broader strategy designed around the actual concerns.
3. Give Every Action an Owner
Every action should have a responsible party. This sounds simple, but it is one of the places management plans often break down. Consider: Increase supervision. Who? Where? When? For how long? Instead: Assistant Principal Rivera will coordinate increased adult presence during Jordan's lunch period beginning Monday. Or:
Counselor Thompson will meet with Jordan every Tuesday and Friday for four weeks and communicate significant changes to the team lead. Or: Jordan's parent will notify the team lead of new threatening communications, concerning online behavior, significant changes in mood or functioning, or new information regarding potential weapon access. Specificity creates accountability.
If everyone owns an action, there is a good chance no one owns it.
4. Put a Timeline on the Plan
Management actions should also have timelines. Some interventions may need to occur immediately. Others will take place over days or weeks. For example: Today: Family communication and immediate safety measures. Within 24 hours: Counselor meeting and assessment of immediate support needs. Within 48 hours: Outside provider referral initiated.
Beginning Monday: Schedule or supervision modification implemented. Twice weekly for four weeks: Trusted-adult check-ins. In seven days: Team reviews implementation and new information. In 30 days: Formal reassessment of the management plan. This helps prevent a common mistake:
Making the recommendation and assuming the intervention occurred.
A referral is not a service. A recommendation is not implementation. A plan should allow the team to verify that what it decided actually happened.
5. Decide What You Are Going to Monitor
"Continue to monitor" appears in countless management plans. But what exactly does that mean? Teams should identify specific monitoring indicators connected to the priority concerns. For Jordan's grievance:
Is retaliatory language increasing or decreasing?
Is his interpretation of the conflict becoming more flexible or more rigid?
Is fixation on particular peers diminishing?
Are new grievances developing?
For social connection:
Has he resumed athletics?
Is he interacting with positive peers?
Is attendance improving?
Is he engaging with trusted adults?
For violent problem-solving:
Are there new violent communications?
Additional attack-related research?
Leakage?
Efforts to acquire a weapon?
Planning or preparation?
Increased interest in a specific target?
The team should also consider changes in overall functioning: Attendance. Academics. Relationships. Emotional regulation. Home functioning. Substance use. Engagement with services. The objective is not simply to wait and see whether Jordan "does something bad." The team should actively look for evidence of both escalation and improvement.
Measure Implementation and Impact
This is an area where management teams can become much more sophisticated without making their process much more complicated. There are really two different things to monitor.
Implementation
Did we do what we said we would do? Jordan attended four counseling sessions. The counselor completed eight check-ins. The parent was contacted weekly. The schedule change occurred. Jordan returned to athletics. Those are useful measures. But they tell us whether the plan was implemented. They do not necessarily tell us whether it worked.
Impact
Now ask: Did Jordan's grievance decrease? Has threatening language stopped? Has fixation diminished? Has his problem-solving changed? Has his connection with adults and peers improved? Has attack-related research stopped? Have any new pathway behaviors emerged? Those are measures of impact. This distinction matters.
"Did we do what we said we would do?" and "Did it make a difference?" are two different questions. Effective threat management teams ask both.
Imagine the team completes every intervention. Counseling? Check. Parent meetings? Check. Increased supervision? Check. Trusted-adult check-ins? Check. But Jordan's grievance continues to intensify and his behavior becomes more concerning. The management plan is being implemented. It is just not working. That is not a reason to keep checking the same boxes.
It is a reason to change the plan.
6. Document Management Over Time
Threat assessment documentation often does a good job capturing what the team knew on the day of the assessment. But management may continue for weeks or months. The documentation should tell that story too. For example:
September 12: Counselor completed scheduled check-in. Jordan continues to describe significant frustration with peers but identified his coach as an adult he would approach if anger escalates. No new threatening communications reported. Later:
September 19: Parent reports Jordan has resumed soccer practice and is spending more time with peers. No additional concerning online searches identified. Jordan remains focused on perceived unfair treatment by one peer. Then:
September 26: Counselor reports significant reduction in retaliatory statements. Jordan continues to attend soccer and has had no reported contact with identified peers outside normal classroom interactions. Now the team can see a trajectory. Is the situation getting better? Worse? Remaining static? Are interventions producing the expected effect?
What new information has emerged? Good documentation should capture management over time, not simply preserve the original assessment.
7. Establish Reassessment Triggers Before You Need Them
Scheduled reviews matter. But some changes should cause the team to reconvene immediately. The management plan should identify those reassessment triggers in advance. Depending on the case, they might include:
A new threat.
New leakage.
Weapon acquisition or attempted access.
Additional attack-related research.
Evidence of planning or preparation.
Increased fixation on a target.
Significant escalation of the grievance.
A major loss, rejection, humiliation, or disciplinary event.
Sudden withdrawal from important supports.
Significant deterioration in functioning.
Suicidal behavior or other crisis behavior.
New concerns reported by an intended target.
Abrupt behavioral changes that concern people who know the student.
Triggers should be individualized to the case. Then answer another important question:
Who needs to know?
If a teacher observes a significant change on Tuesday, the process cannot depend on that teacher knowing the threat assessment team meets next Friday. There should be a clear reporting pathway.
8. Define Step-Down and Closure Before the Case Gets There
Management also needs an exit strategy. Cases should not remain in intensive threat management indefinitely simply because a student once generated significant concern. At the same time, a case should not close simply because:
"Nothing has happened lately."
Instead, teams should identify evidence that would support reducing management. For Jordan, that might include:
The grievance has substantially diminished or is being managed appropriately.
There have been no additional threatening communications.
There is no evidence of continued attack-related planning or preparation.
Positive connections with peers and adults have been re-established.
The student is consistently participating in appropriate supports.
School functioning has stabilized.
Parents report improved functioning at home.
Identified stressors have been resolved or are being effectively managed.
The student demonstrates healthier coping and problem-solving.
Team members have no significant new concerns.
Notice what happened. The team is returning to the priority concerns identified at the beginning of the plan. What has changed? That is a much stronger basis for decision-making than simply asking how much time has passed.
Think of Management as a Dial, Not a Switch
Threat management is sometimes treated as if it has two settings:
OPEN
and
CLOSED
I think a better model is a dial.
Intensive Management
Frequent team review, significant coordination, enhanced supervision or safety measures, intensive services, family involvement, and law enforcement involvement when appropriate. ↓
Active Management
Structured interventions, regular check-ins, targeted monitoring, family communication, and periodic multidisciplinary review. ↓
Reduced Monitoring
Concerns are improving, management actions are reduced, and review intervals become longer. ↓
Maintenance
Threat-specific interventions are largely no longer necessary, but ordinary student supports continue and there is a clear pathway for re-referral. ↓
Closure
Based on documented reassessment, the conditions that required threat-specific management have sufficiently changed and continued BTAM case management is no longer necessary. This accomplishes two things. It helps prevent teams from keeping students in intensive threat management longer than necessary.
And it helps prevent premature closure simply because the immediate crisis has passed.
As the evidence changes, the intensity of management should change with it.
A Practical Management Plan
Put all of this together and the working portion of a management plan can remain remarkably simple.
Escalating peer grievance — Action: Twice-weekly check-ins focused on grievance, coping, and problem-solving. Responsible party: Counselor. Timeline: Begin immediately; review after 4 weeks. Monitoring indicator: Frequency and intensity of grievance/retaliatory statements.
Loss of positive connections — Action: Reconnect Jordan with coach and extracurricular activity. Responsible party: Counselor + Coach. Timeline: Within 5 school days. Monitoring indicator: Attendance, participation, adult/peer connection.
Increasing violent problem-solving — Action: Continued assessment of concerning communications, research, planning, or preparation. Responsible party: Team Lead + Parent as appropriate. Timeline: Immediate/ongoing. Monitoring indicator: New leakage, attack-related research, planning, preparation.
Peer conflict — Action: Address substantiated peer behavior and reduce unnecessary contact when appropriate. Responsible party: Assistant Principal. Timeline: Within 48 hours. Monitoring indicator: New conflicts, intimidation, retaliation.
Family-school information gap — Action: Scheduled school-parent communication. Responsible party: Team Lead. Timeline: Weekly for 4 weeks. Monitoring indicator: Relevant changes at home and school are shared promptly.
Then add:
Next Team Review:
Immediate Reassessment Triggers:
Indicators Supporting Step-Down:
Criteria Supporting Closure:
Documentation Location/Case Record:
This is not complicated. But it is operational. A team member should be able to look at the plan and know:
What are we worried about?
What are we doing?
Who is doing it?
When?
What are we watching for?
When are we meeting again?
What would bring us back sooner?
How will we know when we can do less?
That is a management plan people can actually implement.
Management Is More Than Counseling
There is another important distinction. A behavioral threat management plan is not the same thing as a mental health treatment plan. Mental health services may be extremely important. But the factors contributing to a concerning situation may extend well beyond mental health. Management may need to address:
Grievances.
Peer conflict.
Bullying.
Access to weapons.
Family circumstances.
School connectedness.
Academic difficulties.
Disciplinary consequences.
Social isolation.
Online behavior.
Substance use.
Victim safety.
Behavioral boundaries.
Supervision.
Schedule or environmental issues.
Community supports.
NTAC's current school guidance describes BTAM as examining concerning behavior in context, including circumstances such as bullying experiences, stressors, mental health needs, home-life factors, and substance misuse. (United States Secret Service)
That is exactly why management should be multidisciplinary.
The intervention should match the problem identified through the assessment.
Discipline Isn't a Management Plan Either
The same is true of discipline. There may be circumstances where disciplinary action is completely appropriate. But suspension, expulsion, or another consequence does not automatically resolve the factors that generated concern. In fact, disciplinary action may change the situation. If Jordan is suspended: What happens to supervision? Does his grievance increase?
Who maintains contact? Do services continue? What is happening online? Does he retain access to the people he is angry with outside school? What will reentry look like? Does the disciplinary action itself create a new stressor or perceived injustice that the team needs to understand? Those are management questions. The consequence may be appropriate.
But the consequence does not replace management.
Change the Questions at Your Follow-Up Meetings
Once a student enters management, the team's meetings should also look different. You do not need to repeatedly conduct the original assessment from scratch. Instead, structure follow-up meetings around questions such as:
What has changed since our last review?
Were the assigned actions completed?
What did we learn from them?
Which priority concerns have improved?
Which remain unchanged?
Has anything worsened?
Have new concerns emerged?
Are our interventions having the intended effect?
Do we need to add, remove, or modify an intervention?
Does the current intensity of management still match the concern?
Has a reassessment trigger occurred?
Is there evidence supporting step-down?
Those questions keep the team focused on management rather than simply reviewing the same information at every meeting.
The Entire Process Can Be Reduced to Six Words
For teams trying to improve their management process, start here:
CONCERN
What specifically are we trying to change, reduce, interrupt, support, or monitor? ↓
ACTION
What are we going to do about it? ↓
OWNER
Who is responsible for making sure it happens? ↓
TIMELINE
When will it happen? ↓
INDICATOR
What information will tell us whether things are improving, remaining static, or escalating? ↓
REVIEW
When will we reassess and adjust the plan? Then surround that process with two additional requirements: DOCUMENTATION What happened? What changed? What did we learn? TRIGGERS & TRANSITION CRITERIA What requires immediate reassessment? What evidence allows us to reduce management? What would eventually support closure? That gives teams a practical management cycle:
Assess → Prioritize → Act → Monitor → Reassess → Adjust
And repeat it for as long as the circumstances require.
Seven Questions to Ask About Your Current Process
If you lead a school or district BTAM program, take one of your current management plans and ask:
1. Can we clearly identify the priority concerns driving management?
2. Can every intervention be connected to one or more of those concerns?
3. Does every action have an owner and timeline?
4. Have we identified indicators of both escalation and improvement?
5. Are we measuring both implementation and impact?
6. Does everyone know what would trigger immediate reassessment?
7. Can we explain what evidence would allow us to step down and eventually close management?
If the answer to several of those questions is no, you may have a well-developed threat assessment process but an underdeveloped threat management process. That distinction matters.
Assessment Creates the Opportunity. Management Is the Work.
The first article in this series focused on an important idea:
Assessment is only the beginning.
This article takes the next step. Once we identify what concerns us, we need a process that translates those findings into action.
At School Safety Solutions, this is an area I encourage teams to spend significant time developing. Teams need more than an assessment instrument. They need a repeatable management process that helps them determine what happens on the day after the assessment---and in the weeks and months that follow.
NTAC describes behavioral threat assessment as providing an avenue for early intervention and emphasizes addressing the factors that appear to be driving an individual toward violence. (United States Secret Service)
That is where the real opportunity for prevention exists. Not in the category assigned to the case. Not in the number of boxes completed on an assessment form. And not simply in the fact that the team met. It exists in what happens afterward. A grievance begins to resolve. Access to a weapon is interrupted. A student reconnects with an adult.
Parents and the school begin sharing information. A peer conflict is addressed. The student receives effective support. Concerning behavior decreases. A team notices that an intervention isn't working and changes it. And eventually, the factors that required intensive management have changed enough that the team can responsibly reduce its involvement.
That is the progression we should be trying to build:
Identify the concern.
Prioritize what matters.
Build the intervention.
Assign the work.
Monitor both implementation and impact.
Document change.
Reassess when circumstances change.
Adjust the plan.
Step down when the evidence supports it.
Close when threat-specific management is no longer necessary.
That is how assessment becomes action. And ultimately, management is where the opportunity for prevention becomes practice.
Want help building a behavioral threat management process your team can actually implement? Explore our school safety services or reach out to talk through next steps.
School Safety Solutions helps K-12 leaders strengthen prevention, protection, and preparedness through practical assessment, training, tabletop exercises, Standard Response Protocol implementation, behavioral threat assessment support, and reunification planning. If your district wants a calm, working review of its active shooter protocol and broader emergency readiness, visit School Safety Solutions or call 512-387-6729 to talk through next steps.
Comments