This article was last updated on February 15, 2018.
An armed intruder approaches your building – what kind of resistance will they encounter?
Effective access control, automated communication, and rehearsed emergency plans are your best defenses against workplace violence. These measures may not prevent an aggressor from entering your building, but they will create necessary delays in a situation where every second counts.
Treat your building as a security tool, not a potential tragedy scene. It's time to bring facilities management to the table in our national conversation about mass shootings.
A Threat Unlike Any Other
Rewind the clock before 9/11 and only a handful of specialty facilities were concerned with counterterrorism measures. This is no longer the case and as the Las Vegas shooting illustrates, any building can be exposed to violence on this level. The Columbine, Newtown and Parkland shootings may have put school security in the limelight, but workplace homicides continue to occur in all building types regardless of form, function, or occupancy.
"The reality is that this type of violence is foreseeable and building owners need to respond accordingly," says Randy Atlas, president of Atlas Security & Safety Design. "Every industry is on notice."
In 2012, there were 463 workplace homicides, reports the Bureau of Labor Statistics – 80% of which involved firearms. There have been a total of 6,850 fatal shootings in the workplace between 1997-2010, an average of 525 deaths a year. It's no wonder that a Securitas survey of Fortune 1000 companies shows that workplace violence remains the second highest concern after cyber security.
Owners know that the ripple effects of a mass shooting extend far beyond the confines of the physical property. Whether lives are lost or not, public scrutiny quickly points the finger of liability at property management. The financial repercussions can be acute.
"Workplace violence has an annual estimated price tag of $5 billion in direct and indirect costs for building owners, managers, and employees," notes Thomas Mitchell, managing director of Facilities & Asset Management Consulting Services at Booz Allen Hamilton, a global strategy and technology consulting firm. "These costs include personnel replacement, lost productivity, property damage, administrative resources, and potential litigation."
No crime or disaster is completely preventable, but buildings still make an effort to create a safe environment and plan ahead for emergency response. You already have a number of risk mitigation tools at your disposal – it's just a matter of using them.
"The only barrier to hardening a facility is the checkbook," notes Chris Grollnek, an active shooter prevention expert with Countermeasure Consulting Group. "Your budget dictates how far your security can go."
Review Security Fundamentals
You don't have to put a moat around your property or turn it into a fortress to increase security. Turn to the basic rules of CPTED – crime prevention through environmental design. This concept limits opportunities for crime through strategic design choices. Focus on visibility, access control, and territorial reinforcement.
"You don't want to rely too heavily on only one or two of these principles. That's putting all of your security eggs in one basket," cautions Grollnek. "Research shows that each element of CPTED design you add exponentially increases security and safety levels."
The problem is that not all facilities were built with CPTED in mind, and these strategies may be counterproductive to business practices. Atlas points to malls as an example of just how vulnerable buildings can be.
"By design, a mall invites the mass public onto the property. Almost anyone can walk in unchallenged as there are virtually no security checks," Atlas says. "These large, open spaces often have poor boundary definition and dozens of unrestricted entrances."
Commercial facilities may also experience similar challenges. Recruit the help of a consultant to scrutinize every aspect of your building's layered security. If upgrades aren't on the table, focus on egress integrity. Security breaches can be enabled by something as simple as a broken door (see "6 Tips for Door Security").
"The best thing we can do is secure our facility internally and externally to slow down the progress of perpetrators so law enforcement can arrive and prevent the situation from escalating," Mitchell says.
Strengthen Access Control
Beyond physical deterrents, it's often the human side of security that can make the most difference in an active shooter situation, notes Grollnek.
"Most buildings aren't designed to prevent violence on this scale. The probability of an all-hazards event like terrorism or a shooter is very low and it may not be cost- effective to change the existing layout," Atlas says. "Policies and procedures, training, and communication are the most important things that will improve security and minimize the risk of an active shooter situation."
Lax security practices can turn any building into a soft target, particularly if you aren't keeping tabs on who is allowed onto the property.
While controlled access offers some of the best protection, the system must be kept current with permissions. Otherwise, the badges of former employees, visitors, or temporary contractors could still be active.
"If you have 600 employees and there are more than 900 access cards, you know you have a problem," says Sean Ahrens, a security expert with Aon Global Risk Consulting.
This discrepancy can be reduced if there is a mechanism in place that identifies when an employee is no longer with the company, he adds. Far too many workplace homicides involve former workers, so it's imperative that their access privileges have been revoked. This is especially true if they return for an unannounced reason.
"Access control protocols should be to deny entry to former employees who were discharged for cause or resigned under contentious conditions. The admittance of these fired or disgruntled individuals at the workplace needs to be denied tactfully or authorized after an evaluation of all the related factors for the visit," stipulates the 2012 ASIS report Mass Homicides by Employees in the American Workplace.
You may need to review your visitor policies as well. Some organizations use a lobby or waiting area as a sort of holding tank while a guest is authorized prior to allowing access, says Ahrens. Not only does this give a guard or receptionist time to confirm the visit, but it isolates the individual from building occupants.
You should also have a policy in place to verify a person's identity, says Pizzitola. He has visited many buildings that required him to sign in but never asked for any identification. A few scribbles in a log book are an empty gesture that should be eliminated.
If you have guards, confirm they have the proper training and tools to respond to an active shooter threat. Some personnel are only on a premise to observe and report whereas others have permission to engage with a suspect.
"Profile training for behaviors is number one for dealing with active shooters," states Atlas. Suspicious activity can be a red flag, such as someone wearing a long jacket on a warm day or carrying a duffel bag when there's not a gym nearby.
Update Emergency Plans
Even the best security measures can be breached if an intruder has enough time and determination. Once controls have been defeated, every second counts. An active shooter incident is typically over in 12 minutes, says Grollnek, and police may not arrive before the situation has played out. Does your emergency response plan have guidelines for what to do as those minutes tick by?
If your plan is silent on the topic, take the time to make revisions. You don't need to reinvent the wheel, says Mitchell. Network with comparable organizations or neighboring buildings to learn how others have anticipated these threats.
"An organizational analysis may be necessary to identify all of the key stakeholders," Mitchell notes. "Consider not only availability but capability of an individual to perform emergency duties."
Each player should know what their specific responsibilities are under an active shooter threat. Training may be necessary to fill in any gaps. Once stakeholders have been identified, you can draft a sequence of events.
Now it's time to put that plan into action. Employees may receive emergency information as part of their orientation training, but will they remember it under extreme stress? Precious time is wasted if occupants have to stop and think about what to do. Frequent drills can make recalling instructions an automatic response.
"A natural disaster and an active shooter incident are very similar – you need to get a large number of people to a safe location in a very short amount of time," Grollnek explains. "Common sense tells you the best way to do this is to practice it beforehand."
Schedule periodic drills or fold them into other emergency awareness exercises. "Drills need to be embraced by upper management and incorporated as part of the safety culture," Pizzitola stresses. "If leadership sets a good example, employees will be more likely to take emergency exercises seriously."
Practicing the plan will also give you the opportunity to see how it works in a controlled environment.
"An exercise should reveal areas that don't properly or adequately address the level of emergency response," Mitchell explains. "You need to have earnest, honest feedback. How did it go? What could you have done better? What needs to change moving forward?"
There's no reason to feel helpless against an active shooter. Rely on your building's inherent defenses and plan ahead for a worst case scenario. Your occupants are counting on it.
Jennie Morton is senior editor of BUILDINGS.