Behavioral Threat Assessment and Management (BTAM): Best Practice Considerations for K–12 Schools

Behavioral threat assessment and management (BTAM) is a fact-based, systematic process designed to identify, assess, and manage potentially dangerous or violent situations. School safety experts, law enforcement officials, and the United States Departments of Education, Justice, Secret Service, and Federal Bureau of Education (2017, 2018) have cited research indicating that before a student commits an act of violence on a school campus, warning signs are usually evident. Research and best practice guidelines provided by these entities also indicate a collaborative, multidisciplinary approach to behavioral threat assessment and management can identify effective interventions and supports that mitigate a potential threat and help the person(s) toward a more positive pathway.

Research has also shown that when BTAM is implemented according to best practices and implemented with fidelity, students on which a threat assessment has been conducted are more likely to receive counseling services and a parent conference and less likely to receive long-term suspension or an alternative placement (Cornell et al., 2012). Preliminary research has also shown that when implemented correctly, no disparities were found among Black, Hispanic, and White students in out-of-school suspensions, school transfers, or legal actions; thus, a threat assessment process may reflect a generalizable pathway for achieving parity in school discipline (Cornell et al., 2018). The primary goal of BTAM is intervention. Violence is preventable, and school threat assessment teams are a critical component to school safety.


Threat assessment is most effective when embedded within a comprehensive multitiered system of supports (MTSS) that involves interdisciplinary collaborative partnerships focusing on prevention. A Framework for Safe and Successful Schools (Cowan et al., 2015) specifies best practices for establishing safe and successful schools utilizing MTSS. This framework can help to identify students before they enter onto the pathway to violence and also identify students in need of additional supports. The outcomes of an effective BTAM process can lead to an increase in school engagement activities (e.g., mentoring program), additional interventions and supports within and outside of the school (student assistance teams, school/community mental health services), the initiation or current revision of plans (e.g., Individualized Education Program [IEP], 504 plan, functional behavioral assessment, behavior intervention plan), and/or engagement in a problem-solving process. The goal is to focus on providing interventions and supports, not just punishment. While punitive outcomes are a possibility, particularly if a law or district conduct code has been violated, the overuse of punishment or punishment used in absence of also engaging interventions and supports can do more harm than good. Collaborative partnerships between schools, community agencies and providers, parents, and students themselves, help lead a student to a pathway of successful educational and life outcomes.


An increased number of states have passed legislation that requires the establishment of a threat assessment team and/or process[1]. In addition, multiple government agencies have recommended schools establish threat assessment policies, procedures, and teams (e.g., U.S. Departments of Education, Justice, Homeland Security, Federal Bureau of Investigation [FBI], and the U.S. Secret Service National Threat Assessment Center).

In addition, when there is a safety concern, schools must balance safety with student privacy interests. While many school professionals are hesitant to share information out of fear of violating confidentiality, FERPA contains a “health or safety emergency exception.” This exception allows for school officials to disclose PII [personally identifiable information] from educational records without consent to appropriate parties only when there is an such as an articulable and significant threat. In addition, FERPA does not cover personal knowledge or observations. Thus, professionals may share their personal observations if there is a potential safety concern (e.g., a teacher overhears a student making threatening remarks to another student, the teacher is not prohibited from sharing that information with appropriate parties who are responsible for school safety (e.g., designated BTAM team members, administrators, law enforcement/SRO, school mental health professionals).

One of the questions that arises is: Can information from educational records be shared with members of the BTAM team who are not employees of the school district? Information from educational records can be shared with the BTAM team, and this can include law enforcement and community mental health providers. This information can be shared without getting consent when a school system demonstrates that members of the BTAM have a legitimate educational interest. The BTAM process can ensure that members of the team do not redisclose personally identifiable information (PII). By having members sign a written agreement specifying any FERPA requirements and responsibilities, it helps members to understand that the disclosure can only be made for BTAM purposes.

For additional guidance on legal and ethical guidelines see:


Elements of a quality BTAM include: (a) establishing authority and leadership to conduct inquiry; (b) developing a multidisciplinary threat assessment team and provide ongoing training; (c) establishing integrated and interagency systems relationships and partnerships; (d) providing awareness training for staff, students, parents, and community partners; and (e) establishing proactive and preventive social and emotional initiatives that prevent or mitigate the concerns of those that want to harm others. This includes initiatives that support bullying and suicide prevention, trauma informed practices, social–emotional learning (SEL), sexual harassment prevention, and more. Thus, school boards should adopt threat assessment policy and procedures which establish the authority for school professionals to act upon reported threats and/or concerning behaviors, and provide guidance on the establishment of a best practice model. While the details will vary by school/district, all BTAM policies and procedures should include:

  • Establishment of threat assessment teams at the school and/or district level;
  • Roles and duties to be performed by designated BTAM members;
  • Expertise and training of professionals who will serve on the team;
  • Awareness training for staff, students, and parents;
  • Confidential reporting procedures and requirements (i.e. mandatory reporters);
  • Time frame required to responsibly act upon reported concern;
  • BTAM protocol, procedures, and documentation, including exceptions to confidentiality;
  • Establishment of policies and procedures for the development of proactive and preventive interventions and supports for students and staff members;
  • Establishment of policies and procedures for providing mental health supports with a combination of school and community-based mental health professionals that provide a continuum of services for students and staff;
  • Engagement of school resource officers (SROs)/law enforcement in threat assessment process, to include parameters of information sharing; and
  • Procedures for disciplinary actions and/or change of educational placement, if warranted.


Implementing the essential elements listed above is critical to making informed decisions based upon objective data and to minimizing the risk of making erroneous decisions based upon profiling characteristics, personal biases, or misperceptions. Threat assessment is also not the same as profiling, and individuals “don’t just snap” but engage in a process of thought and behavior that escalates.

Workplace Violence

While beyond the scope of this document, workplace violence can also impact school safety. Disgruntled or former employees, or personal relationships that become hostile and/or violent, can also pose a risk to school safety. Thus, districts must also have a formal process for assessing workplace-related threats of violence. Human resources most often works in collaboration with the school safety and security, the school system’s mental health resources, and law enforcement, as needed. Protocols need to be established regarding who will conduct the threat assessment if the person of concern is an adult, how staff members report concerns for personal safety or safety of colleagues, mandated reporting requirements for protective and/or restraining orders, and support must be provided to help those involved. Due to an employee’s right to privacy and confidentiality, information disclosed must be to protect the safety of individuals in the workplace and may be limited to that reasonably necessary to protect the employees and others.


It is important to note that BTAM is not a predictive model for future violence, nor is it a foolproof method of assessing an individual’s or group’s risk of harm to others. However, BTAM can help to identify potential threats and assist schools in development of an intervention and management plan that addresses both physical and psychological safety.

The National Threat Assessment Center (NTAC) and U.S. Secret Service and Department of Homeland Security (2018) have outlined a best practice threat assessment model for schools based on their 20 years of research, training, and consultation on threat assessment and preventing targeted acts of violence. The eight steps below outline the critical components to be included in a high-quality BTAM process.

Step 1. Establish a Multidisciplinary Threat Assessment Team

Prior to conducting threat assessments, the BTAM team must be carefully selected and receive appropriate BTAM training. They must have expertise in school administration, mental health, academic instruction, and law enforcement. The core BTAM team should include an administrator, at least one school mental health professional (school psychologist, school counselor, school social worker), and a school resource officer (SRO)/law enforcement for moderate, high, or imminent risk situations (Reeves, 2020; Maryland Center for School Safety, 2018). Out of this core team, it is also highly recommended the administrator or school mental health professional is assigned as the case manager/team leader to ensure the process is conducted thoroughly, ethically, legally, and with fidelity, and that it ensures proper documentation is completed and retained according to district guidelines, and federal and state laws. Back-up team members also need to be trained and accessible to fill in when primary team members are unavailable (e.g., administrator is out of the building attending a conference). In addition, the BTAM team should consist of individuals who have an understanding of working with individuals with disabilities and those who speak a language other than English. This should be required when you have a person of concern or potential targets who has a disability and/or speaks a language other than English (Maryland Center for School Safety, 2018).

Below is an example of typical duties assigned. Each team will need to determine the specific roles and responsibilities for their respective team members.

School Administrator

  • Consults with core team members to determine if a full threat assessment inquiry is necessary.
  • Assists in conducting interviews of subjects, targets, witnesses, teachers, staff, parents, and students.
  • Assists in gathering additional information (e.g., school records).
  • Determines and enforces disciplinary consequences, if appropriate.
  • Ensures that any threat management plan is followed and monitored.
  • Works closely with the public information officer or communications director to respond to community concerns and questions.

School Mental Health Professional (School Psychologist/Social Worker/Counselor)

  • Consults with administration and other core team members to determine if a full threat assessment inquiry is necessary.
  • Leads or assists in conducting interviews with subjects, targets, witnesses, teachers, staff, parents, students.
  • Serves as a liaison to community mental health providers.
  • Advises the team on school-based and community interventions and supports, including possible mental health assessments, where appropriate.
  • Assists with next steps and possible referrals.
  • May provide interventions and supports.

School Resource Officer (SRO)

  • If appropriate, assists in conducting interviews of subjects, targets, witnesses, teachers, staff, parents, and students.
  • Assists with efforts to ensure safety and security.
  • Conducts independent criminal investigations, as needed.
  • Serves as a liaison to law enforcement, court personnel, juvenile justice, probation, and others.
  • Uses discretion to determine the need for welfare checks, weapons checks, and home searches, where permissible.
  • Assists with next steps and possible referrals.

In addition to the core team members above, other professionals with knowledge of the person of concern and situation are asked to contribute information and ideas for supports and resources. These professionals may include teachers, a special education case manager, a behavior specialist, coaches, mentors, and school support staff. If the situation is serious, the involvement of legal counsel may be necessary and, if the situation involves staff, human resources may also be a contributing member.

If the threat is serious and valid, there may also be situations where the school team consults with outside experts such as a threat management specialist, a psychological evaluator, and/or a mental health therapist. It is important to note that outside experts must work collaboratively with the school/district BTAM team and should never replace the school team. The school team has access to critical data and knowledge of situational and relationship dynamics the outside expert may not be able to access, or if the evaluation is delayed, the stressors may be minimized by the client. An outside evaluation should also never replace the school/district’s BTAM process, nor does it absolve the school/district team from completing a thorough BTAM process. This includes law enforcement officers who may go to the home of the person of concern to conduct wellness checks that determine the threat is not imminent. All parties have critical information and perspectives needed to help mitigate risk, and thus intervention planning needs to be collaborative.

Step 2. Define Prohibited and Concerning Behaviors

A key distinction is the difference between making a threat and posing a threat. Schools serve students with a variety of developmental ages, disabilities, and emotional maturity levels. There are times when students may make a threat, but there is no genuine intent to harm. This type of threat may have been in response to a specific frustrating situation, stated as a sarcastic joke, or impulsive in nature with no intent to harm. The BTAM team needs to assess if the individual who made the threat “in the heat of the moment” wants to implement the threat. Previous research suggests that as many as 70% of threats may be transient (Cornell et al., 2004). When BTAM is properly implemented, if the threat is identified as low level/minimal/transient it can often be resolved or managed through a problem-solving process or existing supports. Thus, while the individual of concern made a threat, they do not pose a threat, and this situation can be used as a learning opportunity or as an opportunity to increase supports.

However, there are individuals who may pose a threat, and the school community needs to be educated on behaviors that are unacceptable. Thus students, staff, and parents need to be explicitly taught to recognize and report when someone is struggling and is at risk for potential harm to self and/or others. These threats have communications, context, and meaning to support a legitimate safety concern (medium/high/imminent; substantive), a possible intent to harm others (verbal, nonverbal, electronic, written, pictures, gestures, social media), person(s) on receiving end is concerned, and the threat was not perceived as a joke or taken out of context. Thus, the BTAM assessment identifies more specifically the level of concern and actions needed to assure safety.


Thus, the BTAM team must stay objective when reviewing the facts of the case, as fear and emotions frequently affect why a person considers a threat an actual threat. BTAM team decisions need to be based on objective facts, not emotions. The BTAM team also needs to take into consideration their own biases to ensure this process does not contribute to the disproportionality that exists within disciplinary practices.

Step 3. Develop a Central Reporting Mechanism

In order for the BTAM team to appropriately identify safety concerns, school communities must be willing to overcome the bystander effect (noticing a concern and not reporting) and report. Ongoing awareness training is needed on what, when, and how to report, and it is also critical for reports to be taken seriously and handled responsibly (i.e., source remains confidential, actions taken are appropriate to the level of threat). If overly punitive actions are taken, students will stop reporting, as they do not typically want to be responsible for getting a peer suspended or expelled from school or for receiving serious punitive consequences only to find out the threat was not legitimate.

The BTAM teams also need to be aware of any cultural implications that may impact others’ willingness to report. Due to past community traumas or historical incidents, some communities may believe that it is not acceptable to disclose serious incidents to those in authority. Community beliefs may reflect “not sharing your dirty laundry” or “snitches get stitches.” It is important to understand community beliefs to help schools create a safe school climate where others feel safe enough to report to authority figures.

Various methods for reporting can include directly reporting to a trusted adult, a tip line, a reporting app, email, voice mail, a link on the school/district website to report, and calling 911. It is important to have more than one confidential method to report, and students, staff, and parents need to be explicitly trained on how and what to report and what is not appropriate to report via these methods (e.g., difference between tattling and telling). Regardless of methods selected, they need to be constantly monitored and all information needs to be funneled to the BTAM team.

Step 4. Determine the Threshold for Law Enforcement Intervention

A key goal and principle of BTAM is to distinguish between making a threat and posing a threat. If an individual makes a threat but it is found to be not true, low level, or transient, then law enforcement will not likely need to be directly involved. School personnel can work with the student and parents by implementing a problem solving and/or conflict resolution process. However, if the threat is legitimate and mitigation actions need to be taken, an SRO/law enforcement officer may become engaged in a consultative or direct role to help with the investigation, actions to mitigate risk, and/or actions that promote interventions and supports. Reports involving weapons, threats of violence, and physical violence should immediately be reported to local law enforcement. If the law enforcement officer is not a district staff member, a memorandum of understanding (MOU) may need to be developed that outlines the relationship between school staff and law enforcement and outlines what law enforcement responsibilities will be in the BTAM process.

Step 5. Establish Assessment Procedures

An effective BTAM process is designed to identify, inquire, assess, and manage. Clear and confidential reporting mechanisms help to identify the subject(s)/situation(s) whose behavior or impact has raised concern. The BTAM school/district team then conducts an inquiry to gather additional information in a lawful and ethical manner and assesses information regarding situation, context, developmental, and disability factors to determine if the subject/situation poses a threat of violence or harm to self and/or others. If there is a significant concern for safety, the BTAM team will engage law enforcement, who will determine if an official investigation via law enforcement needs to begin. The situation is then managed by implementing problem solving supports and, if warranted, an intervention and monitoring plan to prevent harm where possible and to reduce/mitigate impact of the situation (Deisinger & Randazzo, 2017).

In addition, the focus of BTAM is to understand the situation and how best to mitigate safety concerns. BTAM is not the same as a criminal or disciplinary investigative process, nor is it profiling. Profiling involves making generalizations about an individual based on the individual’s similarity to high risk groups, whereas threat assessment is an individualized assessment of the person of concern, considering their particular situation at a particular point in time (Deisinger & Randazzo, 2017).


The decisions a BTAM team makes are only as good as the data gathered, and data must be corroborated as much as possible. Thus, a multimethod and multisource approach is needed to look at the context and the interaction among the subject(s) of concern, potential target(s), and environmental stressors and precipitating factors that can increase or mitigate risk (STEP).

Key data sources to consider gathering include the following:

  • Current school academic and discipline records, including previous threat and suicide assessments;
  • Previous school academic, mental health, and discipline records;
  • Law enforcement records of the person of concern;
  • Search of student, locker, car (if applicable) on school property, according to district policy;
  • Search (or search warrant) of room/home/vehicle with law enforcement, if appropriate;
  • Internet histories/activities; written and artistic material, etc.;
  • Social media history/activity;
  • Information from probation, juvenile diversion, social services, and/or other involved agencies;
  • Additional information, if determined necessary/helpful.

Interviews should also take place with the individual of concern, parent/guardian, school staff, potential target(s) of threat, and others who may have information. Interviews can gather information not always captured by observations or records. In addition, interviews allow the BTAM team to assess if the subject’s “story” is consistent with their actions. It is strongly recommended the interview process is led by a school mental health professional as they have received specialized training in interviewing skills. In addition, they are typically not seen as a disciplinarian (i.e., they may reflect a supportive stance), thus the subject will often be more comfortable responding to their questions. School policy may dictate who can conduct the interview with students and staff members. The BTAM team needs to remember that this is not a disciplinary process, so if the person that normally conducts disciplinary interviews is also the person who conducts interviews in the BTAM process, students may not be as forthcoming during the interview.

*Note: If law enforcement/school resource officer leads the questioning, they could be perceived as acting as agents of law enforcement and thus Miranda Rights may need to be read as it can be considered investigative in nature.

The TOADS acronym helps to facilitate data collection and determine imminence and intent. Does the person have the: (a) time to execute their plan; if time is imperative, immediate containment is needed; (b) opportunity to carry out the plan and/or is able to access targets; (c) ability and desire to carry out plan and sees no other option besides violence; (d) stressors are negatively impacting life and decision making, which can serve as a stimulus/trigger for carrying out the harmful act. (Nicoletti, 2002)

In addition to being guided by the TOADS acronym, data need to be gathered to assess for other risk factors and warning signs. Risk factors are variables that increase the probability of a student becoming violent. While far from perfect predictors, they signal the need to increase vigilance for warning signs. Research has identified risk factors fall into the following categories: history of violence, health/mental health challenges, access to weapons, problematic behavioral history, and social/environmental stressors. Table 1 summarizes key risk factors. It is important to reinforce that there is no set amount of risk factors or formula that can predict if an individual will go on to demonstrate warning signs (e.g., pathway behaviors).

Warning signs indicate a person of concern is actually considering an act of violence and is on the pathway to violence. Warning signs in isolation are concerning, but warning signs combined with a number of risk factors and stressors are particularly worrisome. Key warning signs fall into the following categories: pathway behaviors, fixation, identifying with previous acts of violence and/or seeing act as carrying out a cause, novel aggression (e.g., practicing), increase in actions toward implementation, communicating threat (e.g., “leakage”), end-of-life planning and/or increase in actions demonstrating desperation, despair, and seeing no other options besides violence. Direct special attention to the individual who has suicidal thoughts, as such are often paired with homicidal thoughts, and thus a suicide risk assessment may also need to be conducted. Table 2 summarizes key warning signs. It is important to reinforce that there is no set amount of warning signs or a formula that can predict if an individual will act upon the warning signs. Again, it is a complex interaction between the subject(s), target(s), environment, and precipitating events, with contextual and developmental factors also needing to be taken into consideration.

Table 1

  • Socially withdrawn
  • Isolated and alienated
  • Feels rejected
  • Violence/bullying victim
  • Feels persecuted/having been picked on
  • Low school interest and performance
  • Intolerance and prejudice
  • Drug and alcohol use
  • Affiliation with gangs
  • Expresses personal grievance/moral outrage
  • Thinking framed by ideology
  • Failure to affiliate with prosocial groups
  • Dependent on virtual communities
  • Occupational goals thwarted
  • Mental illness
  • Poor impulse control
  • Access to, and possession of, firearms
  • History of …
  1. violent expressions in writings and drawings
  2. serious threats of violence
  3. uncontrolled anger
  4. impulsive and chronic hitting, intimidating, bullying
  5. discipline problems
  6. criminal violence
  7. cruelty to animals

Note. Adapted from Amman et al. (2017); Dwyer et al. (1998); Meloy et al. (2011, 2014, 2015); Reeves & Brock (2017); U.S. Department of Education (2016).

Table 2

Warning Signs for Targeted School Violence

  • Targets identified
  1. Persons
  2. Places
  3. Programs
  • Processes
  • Philosophies
  • Proxies of the above
  • Articulates motives
  • Personal
  • Political
  • Religious
  • Racial/ethnic
  • Environmental
  • Special interest
  • Increasing intensity of violence related
  1. Efforts
  2. Desires
  3. Planning
  • Direct and/or indirect communications about violence
  1. Words consistent with actions
  2. Sees violence as acceptable/only solution
  • Access to weapons or methods of planned harm
  • Leakage of ideations
  • Social withdrawal
  • Emotional state
  1. Hopelessness
  2. Desperation
  3. Despair
  4. Suicidal thinking
  • Feelings of being picked on, teased, bullied, or humiliated
  • Increasing capacity to carry out threats
  • Engagement with social media facilitating or promoting violence
  • Intimate partner problems
  • Interpersonal conflicts
  • Significant losses or personal failures

Note. Amman et al. (2017); de Becker (n.d.); Fein et al. (2004); Langman  (2009, 2015); Meloy et al., (2011, 2014, 2015); Nicoletti & Spencer (2002); Reeves & Brock (2017).

Analyzing Information

Best practice guidelines highly recommend analyzing the information according to the U.S. Secret Service key investigative questions:

  1. What are the person’s motives and goals?
  2. Have there been any communications suggesting ideas or intent to attack or harm others?
  3. Has the person shown inappropriate interest in any of the following?
    1. Workplace, terrorism, school, or campus attacks or attackers;
    2. Weapons (access to or recent acquisition of weapons);
    3. Incidents of mass violence (terrorism, workplace violence, mass murderers);
    4. Obsessive pursuit, stalking, or monitoring others.
  4. Has the person engaged in attack-related behaviors (i.e., planning; any behavior that moves an idea of harm forward toward actual harm)?
  5. Does the person have the capacity to carry out an act of targeted violence?
  6. Is the person experiencing hopelessness, desperation, and/or despair?
  7. Does the person have a trusting relationship with at least one responsible person (e.g., a teacher, family member, coach, counselor, advisor)?
  8. Does the person see violence as an acceptable, desirable, or only way to solve problems?
  9. Is the person’s conversation and story consistent with his or her actions?
  10. Are other people concerned about the person’s potential for violence?
  11. What circumstances might affect the likelihood of violence—either increase it or decrease it (stressors and/or protective factors)?

Pathway to Violence

The data sources are then analyzed to help determine if the subject actually poses a threat, meaning they demonstrate behaviors on the pathway to violence. Pathway behaviors include ideation, planning, preparation/acquisition of methods to carry out act, and implementation; it begins with ideation and escalates to implementation without interventions. An effective BTAM process can interrupt this pathway and help an individuals off the pathway (Deisinger & Randazzo, 2017).

Step 6. Develop Risk Management Options

The BTAM team should consider ALL data, including risk and protective factors. The FBI (2017) proposes BTAM teams identify levels of concern, which in turn guide the team in directive actions and supports to be taken. It is important to note that levels of concern are not to be used to predict human behavior or to automatically determine a change of educational placement, but are to be used to design interventions and supports; there is no magic or mathematical formula or a specific number of risk factors and warning signs that determine any specific level. Risk factors and warning signs are considered along with situational and contextual factors, and the higher the level of concern, the more directive and intensive the supports must be. Levels of concern can also help to ensure that appropriate interventions are recommended. For example, suspension or expulsion should not be utilized for a low-level concern. The following are offered as guidance in assisting BTAM teams to conceptualize each level of concern (FBI, 2017; Virginia Center for School and Campus Safety, 2016).

Low level concern Individual/situation does not appear to pose a threat of violence or serious harm to self/others, and any exhibited issues/concerns can be resolved through problem solving measures.

Moderate level concern Person/situation does not appear to pose a threat of violence, or of serious harm to self/others at this time, but exhibits some behaviors that indicate potential intent for future violence or serious harm to self/others; and/or exhibits other concerning behavior that requires intervention.

High level concern Person/situation appears to pose a threat of violence, is exhibiting behaviors that indicate both a continuing intent to harm and efforts to acquire the capacity to carry out the plan, and may also exhibit other concerning behavior that require immediate interventions to mitigate risk.

Imminent concern Person/situation appears to pose a clear and immediate threat of serious violence toward others that requires immediate containment to protect self (law enforcement or mental health hold/admission) and actions to protect identifiable target(s).

Interventions and Management

The BTAM team should develop a written plan that assists the individual(s) of concern who engaged in threatening behaviors. To effectively manage and mitigate potential risk, interventions need to focus on building resiliency and protective factors for the subject while also addressing safety concerns. Thus, schools need to consider existing supports and resources available within the school (i.e., MTSS, PBIS, skill-building groups, academic supports, counseling services) and community-based resources. Other strategies to manage threatening situations may include more restrictive measures such as increased monitoring, disciplinary actions (must be appropriate for the level of concern), or a change in programming to better meet the individual’s academic and social–emotional needs. However, more restrictive measures must always be paired with strategies that promote skill building, such as academic and social–emotional supports, and increased opportunities for relationship building and mentoring. Environmental stressors such a bullying and discrimination may also need to be addressed by implementing universal prevention programming and positive school climate initiatives (Maryland Center for School Safety, 2018; Reeves, 2020).

It is critical to note that punitive measures, such as suspension and expulsion, can increase risk! Actions that further disconnect the person of concern from monitoring and supports can further escalate emotions and disconnect the person from the school and social environment. Thus, these types of consequences should be implemented only after careful team consideration and should always be paired with supportive interventions. For example, mitigation may best be done by not suspending the student of concern and keeping them at school in order to implement interventions and supports. This keeps the student connected and supervised and also decreases the opportunity for them to be at home alone where they have more time to conduct research and plan how to carry out the act of violence. In addition, further disconnecting the student can increase grievances. A recent analysis of K–12 school shootings (National Threat Assessment Center, 2019) showed grievances to be the most common motive. In addition, 41% of school attacks took place within the first week back to school following a break in attendance (i.e., suspension, school holidays, absence due to illness or truancy). Twenty-four percent of the attacks took place on the first day the attacker returned to school after an absence, and in two of the incidents, the attacker was suspended from school at the time of the attack. These findings support the importance of facilitating positive student engagement following discipline. This can be a significant change in thinking and culture as many individuals falsely think that suspending or expelling makes a school safer with the individual of concern gone. However, that only shifts the potential threat to the community. Thus, the BTAM team will need to work with school administration to manage victim fear and address any potential school/community political tension that may occur.

In addition, if the student is receiving special education services, it is important to follow special education procedures and guidelines. It is important to note that completion of a threat assessment does not automatically necessitate a referral for special education or a change in placement. While some moderate to high risk cases may require the need for a special education referral, the BTAM team must be careful to not inappropriately refer students for special education due to individual fears of the student. A referral to special education is only appropriate if the student may potentially have a disability to warrant special education qualification.

Table 3 lists various interventions and supports for consideration. Please note this list is not all-exhaustive, and schools can customize based upon available supports and resources.

For each case, a member of the BTAM team should be designated as a case manager to monitor the status of the individual(s) of concern. The case manager should notify the BTAM team of any change in status, response to intervention/referrals, or additional information that would be cause for a reassessment and changes in intervention strategies. Updates regarding the case should be regularly documented in accordance with school system policy and should occur until the case is resolved. Resolution and closure of the case should be documented in accordance with school system procedures (Maryland Center for School Safety, 2018; Virginia Center for School and Campus Safety, 2016).

BTAM Records

With the exception of imminent risk to safety, there is little legal guidance on the development, storage, and retention of threat assessment records. Thus, each district should obtain guidance from their own legal counsel in regards to the management of threat assessment records. Decisions on record keeping are important, as maintaining records establishes a legal and behavioral justification for intervention. Case law has supported that if a school had foreseeability (even the slightest inclination there was a safety concern), the school is obligated to act upon the concern; otherwise claims of negligence could be made. Thus, it is critical for BTAM teams to document the actions taken to support their good faith efforts to identify, inquire/investigate, assess, and manage threatening situations.

Teams are also encouraged to retain BTAM records as long as allowed under relevant laws or regulations. Retention of such records can be important as individuals may pose an ongoing threat after leaving school, graduating, or losing employment. At minimum, school-level BTAM teams need to establish a confidential record-keeping system. Ideally, school-level BTAM teams should provide a copy of the completed BTAM protocol to a district-level coordinator/
administrator. This allows for accountability that the process is being done with fidelity, creates a back-up record in case the record needs to be referenced in the future, and also allows for the gathering of statistics to inform strategic investment of future needed BTAM resources. Districts also need to develop guidelines of how the records are moved when a student transitions between schools and outside of the school district (Maryland Center for School Safety, 2018).

Table 3

Disciplinary/Punitive Actions

  • Letter of apology
  • Conflict resolution
  • Warning
  • Behavior contract
  • Parent meeting
  • No-contact agreement
  • Alternatives to suspension
  • Detention
  • Suspension
  • Habitually disruptive plan
  • Expulsion
  • Law enforcement actions:
  1. Restraining order
  2. Ticketed
  3. Charges filed
  4. Diversion program
  5. Court issued protective orders


  • Check-in, check-out
  • Searches
  • Safety contract
  • Adult monitoring
  • Adult escorts from class to class
  • Modify daily schedule to increase monitoring opportunities
  • Restrictions
  • No-contact agreement
  • Modify school start/ending time
  • Increase monitoring collaboration between school and parent/guardian
  • Parent/guardian will increase supervision
  • Monitor for precipitating events (i.e., anniversaries, losses, perceived injustice)
  • Ongoing collaboration with agency supports, probation/juvenile diversion, mental health professionals
  • Detained, incarcerated, or placed under intensive supervision

Skill Development/Resiliency Building

·     Academic supports

·     Conflict resolution

·     Anger management

·     Social skills group

·     Social–emotional learning curriculum

·     Increase engagement in school activities

·     Increase engagement in community activities

·     Provide feedback and mentoring

·     Engage in leadership activities

·     Decrease isolation

·     Monitor reactions to grievances, precipitating events and provide supports

Additional Interventions

  • Revise IEP/504 plan
  • Intervention team referral
  • Change in transportation
  • Restorative justice practices
  • Evaluation—psychiatric/psychological
  • Special education assessment
  • Change of placement to access more intensive services
  • McKinney-Vento/foster care referral
  • Social service referral


  • Address systemic, procedural, or policy problems that may serve as precipitating events
  • Build a caring and supportive climate and culture
  • Implement effective threat and suicide assessment
  • De-escalation training for staff
  • Enhance social–emotional learning to include:
  1. Bullying prevention
  2. Violence prevention
  3. Suicide prevention
  4. Emotional regulation
  5. Conflict management
  6. Sexual harassment prevention
  7. Digital citizenship
  • Ensure positive dynamics among staff (serves as modeling for students)
  • Early intervention with emerging problems
  • Explicitly teach about confidential reporting procedures
  • Give permission to “break the code of silence” and get help for a peer who is struggling

Centralized Database

More districts are developing and maintaining a centralized database to record completed threat assessments. These records should be stored in a secure, centralized location that is accessible to members of the team, but restricts unauthorized persons from having access. If cloud storage is being used, it is important to ensure the district owns the student records (and not an off-site storage company) and that the records are encrypted. Thus, consultation with technology professionals is often warranted as districts establish record keeping protocols.

Monitor Progress; Stay Engaged

For subjects determined to be low risk, informal monitoring may be sufficient. For those subjects determined to be moderate, high, or imminent risk, more formalized progress monitoring will need to be implemented, and it is highly recommended that follow-up meetings are scheduled to review progress and responsiveness to interventions and supports. It is important to reevaluate the plan and make adjustments as needed. Closure of the case, or placing a case on inactive status, can be done when formal monitoring is no longer needed, and the subject has responded well to interventions and no longer poses a safety concern.

Step 7. Create and Promote Safe School Climates

Prevention and mitigation rely on relationships and connectedness amongst students, staff members, and the community. Individuals must respect, trust, and empower one another to report concerns, and all must feel as if they belong. Research has also shown that violence was prevented because individuals reported concerns to authorities who could investigate. Daniels (2019) concluded that most school attacks were averted because students report their concerns about another student’s concerning behavior and prompt response by school personnel and police were critical to successful prevention.

Prevention and social–emotional learning (SEL) curricula should include lessons on the following topics that help to promoting and sustaining a safe school climate: diversity and inclusion, emotional regulation, conflict resolution, problem-solving skills, bullying, suicide, and violence prevention. Each school should analyze their academic, behavioral, and social–emotional data in order to make data-based decisions regarding prevention and intervention programs needed. While this document cannot review decades of research on the development of safe school climates, additional information can be found in the Framework for Safe and Successful Schools.

Step 8. Conducting Training for All Stakeholders

School safety is the responsibility of all. Thus, direct and explicit training must take place for all stakeholders (students, teachers, support staff, coaches, mentors, parents, community members) so they know how and when to report. Confidential reporting procedures must be easily accessible and monitored so concerns can be responded to quickly. Again, the effectiveness of the BTAM process relies greatly on the information coming forth.

The BTAM team needs high-quality training that focuses on the knowledge and skills needed to effectively implement the K–12 BTAM process with fidelity. When selecting high-quality training, it is important to ensure the BTAM model is validated and uses a multidisciplinary approach. The model must be standardized yet flexible to meet varying resources. Due to the unique educational environment and populations served in schools, it is strongly encouraged the BTAM trainers have experience in conducting and working actual K–12 threat assessment cases, have experience with K–12 implementation, have worked in K–12 schools, have served on a K–12 threat assessment team, and/or served on a BTAM team that actively works K–12 cases. At minimum, administrators, school mental health professionals (school psychologists, counselors, social workers), and SROs should all be trained, preferably together in teams. The training should focus on protocols and processes of systematic implementation, biases that can impact decision making, and integrate case studies. Lastly, ongoing coaching and supports should be provided, as implementation of the process and learning how to effectively assess BTAM cases of concern takes time and experience. Systems should also be developed to support new members joining the team each year.

In summary, an effective BTAM process integrates the above-mentioned best practice guidelines. However, learning about best practices is just a first step. Knowing how to implement BTAM effectively, and with fidelity, is critical to saving lives, enhancing school safety, and ensuring legal and ethical guidelines are followed.


Protecting America’s Schools: A U.S. Secret Service Analysis of Targeted School Violence. (2019). Available at:

Enhancing school safety using a threat assessment model: An operational guide for preventing targeted school violence. (2018). Available at:

Making Prevention a Reality: Identifying, Assessing & Managing the Threat of Targeted Attacks. (2017). Available at:

The Final Report and Findings of the Safe School Initiative: Implications for the Prevention of School Attacks in the United States. (2002). Available at:

Threat Assessment in Schools: A Guide to Managing Threatening Situations and to Creating Safe School Climates. (2002). Available at:

Guide for Developing High-Quality School Emergency Plans. (2013). Available at:


Colorado School Safety and Resource Center

National Association of School Psychologist – Safety and Crisis Resources crisis/a-framework-for-safe-and-successful-schools

Positive Behavior Interventions and Supports (PBIS)

United States Departments of Education, Homeland Security, Justice, and Health and Human Services Readiness and Emergency Management for Schools (REMS) Technical Assistance Center

School Safety

Virginia Center for School and Campus Safety


Amman, M., Bowlin, M., Buckles, L., Burton, K. C., Brunell, K. F., Gibson, K. A., & Robins, C. J. (2017). Making prevention a reality: Identifying, assessing, and managing the threat of targeted attacks. U.S. Department of Justice. Retrieved from

Cornell, D., Maeng, J., Huang, F, & Shukla, K., & Konold, T. (2018). Racial/Ethnic Parity in Disciplinary Consequences Using Student Threat Assessment. School Psychology Review, 47(2), 183–195. doi:10.17105/SPR-2017-0030.

Cornell, D. G., Allen, K., & Fan, X. (2012). A randomized control study of the Virginia Student Threat Assessment Guidelines in kindergarten through grade 12. School Psychology Review, 41(1), 100–115.

Cornell, D., Sheras, P., Kaplan, S., McConville, D., Douglass, J., Elkon, A., McKnight, L., Branson, C., & Cole, J. (2004). Guidelines for Student Threat Assessment: Field-Test Findings. School Psychology Review, 33(4), 527–546. doi:10.1080/02796015.2004.12086266

Cowan, K. C., Vaillancourt, K., Rossen, E., & Pollitt, K. (2013). A framework for safe and successful schools [Brief]. National Association of School Psychologists. Retrieved from safety-and-crisis/a-framework-for-safe-and-successful-schools

Daniels, J. A. (2019). A preliminary report on the Police Foundation’s Averted School Violence Database. Police Foundation.

Deisinger, G., Randazzo, M., & SIGMA Threat Management Associates, LLC. (2017, May). Integrated threat management: A collaborative approach to identifying, assessing & managing threatening behaviors. Workshop presented to Maryland Center for School Safety, Annapolis, MD.

Dwyer, K., Osher, D., & Warger, C. (1998). Early warning, timely response: A guide to safe schools. U.S. Department of Education. Retrieved from

Fein, R., Vossekuil, B., Pollack, W., Borum, R., Modzeleski, W., & Reddy, M. (2004). Threat assessment in schools: A guide to managing threatening situations and to creating safe school climates. U.S. Secret Service and U.S. Department of Education. Retrieved from

Family Educational Rights and Privacy Act of 1974 (FERPA), 20 U.S.C. § 1232g.

Langman, P. (2009). Why kids kill: Inside the minds of school shooters. Palgrave Macmillan.

Langman, P. (2015). School shooters: Understanding high school, college, and adult perpetrators. Rowman and Littlefield.

Maryland Center for School Safety. (2018). Maryland’s model policy for behavior threat assessment. Author. Retrieved from

Meloy, J. R., Hoffmann, J., Guldimann, A., & James, D. (2011). The role of warning behaviors in threat assessment: An exploration and suggested typology. Behavior Sciences and the Law, 30, 256–279. doi:10.1002/bsl.999.

Meloy, J. R., Hoffmann, J., Roshdi, K., & Guldimann, A. (2014). Some warning behaviors discriminate between school shooters and other students of concern. Journal of Threat Assessment and Management, 1(3), 203–211.

Meloy, J. R., Mohandie, K., Knoll, J., & Hoffmann, J. (2015). The concept of identification in threat assessment. Behavior Sciences and the Law, 33, 213–223.

National Threat Assessment Center. (2019). Protecting America’s Schools: A U.S. Secret Service Analysis of Targeted School Violence. U.S. Secret Service and Department of Homeland Security.

National Threat Assessment Center. (2018). Enhancing school safety using a threat assessment model: An operational guide for preventing targeted school violence. U.S. Secret Service and Department of Homeland Security.

Nicoletti, J., & Spencer-Thomas, S. (2002). Violence goes to school. National Education Service.

Reeves, M. (2019, updated 2020). School-based behavioral threat assessment and management: Best practices guide for South Carolina K–12 schools. South Carolina Department of Education.

Reeves, M. A. L., & Brock, S. E. (2018). School behavioral threat assessment and management. -Contemporary School Psychology, 22(2). 148–162. doi:10.1007/s40688-017-0158-6.

U.S. Department of Education. (2013). Guide for developing high-quality school emergency operations plans. Author. Retrieved from

U.S. Department of Education. (n.d.). Balancing student privacy and school safety: A guide to the Family Educational Rights and Privacy Act (FERPA) for elementary and secondary schools. Author. Retrieved from

U.S. Departments of Education, Justice, Homeland Security, & Health and Human Services. (2018). Final report of the federal commission on school safety. Author. Retrieved from safety-report.pdf

Virginia Center for School & Campus Safety. (2016). Threat assessment in Virginia schools: Model policies procedures and guidelines. Author. Available at: assessment-model-policies-procedures-and-guidelinespdf.pdf

Vossekuil, B., Reddy, M., Fein, R., Borum, R., & Modzeleski, W. (2002). The final report and findings of the safe school initiative: Implications for the prevention of school attacks in the United States. U.S. Secret Service and U.S. Department of Education. Retrieved from

Please cite this document as:

NASP School Safety and Crisis Response Committee. (2020). Behavior threat assessment and management: Best practice considerations for K–12 schools. National Association of School Psychologists.

Contributors: Melissa Reeves, Christina Conolly, Scott Woitaszewski

© 2020, National Association of School Psychologists, 4340 East West Highway, Suite 402, Bethesda, MD 20814, 301-657-0270,


[1] As of April 2020, Virginia, Florida, Maryland, Rhode Island, Texas, Tennessee, Oregon, South Carolina, Kentucky, and Minnesota require establishment of teams/process; Georgia requires training but does not mandate establishment of teams. (Note. Many other states have proposed legislation, so list may not be all-exhaustive.)

PDF Version