Insights / Threat Assessment

Who Belongs on a Threat Assessment Team (and What Each Member Does)

By Warren Pulley · November 10, 2026

A threat assessment team needs a small, named core: a designated leader, usually a senior administrator; a mental health professional; a law enforcement or security liaison; and someone with authority over the setting, such as a school administrator or an HR lead. Around that core, add a person who knows the individual of concern, a case manager, a recorder, and access to legal counsel. Name an alternate for every seat. This fall, two states put a version of that answer in writing for schools.

What changed this fall?

Michigan. State law required every school to have a behavior threat assessment and management team by October 1, 2026. The team must include, at a minimum, a school administrator (who is responsible for making sure the team does its job), a mental health professional, and a school resource officer or other law enforcement official from the local agency with jurisdiction. The statute also lists the team’s duties: define prohibited and concerning behavior, assess and inquire into concerning behavior, distinguish credible from noncredible threats, run a central reporting mechanism, set the threshold for law enforcement intervention, and write a plan to assist a student that considers supportive measures alongside any punishment.¹

Maryland. In October 2026, the Maryland School Safety Subcabinet adopted a new Behavior Threat Assessment in Schools Model Policy that replaces the 2018 version. Local boards of education must adopt an aligned policy by December 1, 2027.^2,3 The model names the core members of a school-based team: school administrators, behavioral health professionals, an educator with specific knowledge of the student (such as the case manager when a student has an IEP or 504 plan), and law enforcement or a designated school security official. It also calls for a central, system-level team with senior administrators and staff from mental health, student services, security, and human resources. Its procedures also cover how to determine the threat level of an adult who raises concern.²

Both draw on the Secret Service National Threat Assessment Center’s 2018 school guide, which also says the team needs a specifically designated leader, usually a senior administrator, and agreed protocols for who interviews, who talks to parents and teachers, and who documents.⁴

Who belongs on a threat assessment team, and what does each member do?

• Team leader (chair). Convenes the team, keeps the case moving, and makes sure decisions and their reasons are written down.
• Mental health professional. Helps the team understand stressors, grievances, and the person’s situation, and what support could lower the risk.
• Law enforcement or security liaison. Brings information on records, weapons access, and site security, and knows when the case has crossed the written threshold for police action. Maryland’s model notes that law enforcement can give input at the start of an assessment without that meaning formal law enforcement action.²
• Administrator or HR lead. Holds the authority to change schedules, supervision, access, and assignments, which are often the most useful tools in a management plan.
• Someone who knows the person. A teacher, coach, IEP or 504 case manager, or a direct supervisor. They know the person’s baseline, and threat assessment depends on that.
• Case manager. Carries out and tracks the management plan between meetings and reports new behavior back to the team. Maryland’s model requires a designated case manager to monitor interventions and safety plans.²
• Recorder (case file custodian). Keeps one controlled file: what was known, when, what was decided, and why.
• Legal counsel (advisory). Reviews information sharing under FERPA, HIPAA, and state law, duty-to-warn procedures, and record retention.
• Disability or student services. In schools, makes sure the process respects special education law. Maryland’s model states that threat assessment does not replace any part of IDEA.²

What about workplace threat assessment teams?

The roles carry over with different titles. A workplace team usually includes HR or employee relations, corporate security, a mental health consultant, legal counsel, and a manager from the affected unit. Keep the employee assistance program as a resource the team refers people to, not as a seat on the team, so employees keep trusting it. When a case involves separation from employment, plan it with the team. The termination meeting is where many grievances peak.

My take: the seats that go empty

Across my career I have conducted more than 2,400 threat assessments, and the teams that struggle rarely lack expertise. They lack coverage. The leader is out when the call comes in, and nobody else has the authority to convene. Nobody in the room knows the person’s normal behavior, so a bad week looks like a pathway to violence or a real escalation looks like a bad week. Or nobody owns follow-up, so a sound plan is never carried out.

Michigan’s statute and Maryland’s model both set minimums. Meeting the minimum on paper is not the same as having a team that can meet within hours, agree on facts, and act. Treat the legal roster as the floor, not the finished design.

Team readiness checklist

• Every seat has a named member and a named alternate, with after-hours contact details.
• One person is designated as leader, and the alternate knows they may convene the team alone.
• The law enforcement threshold is written down: which facts mean an immediate call.
• Every open case has a named case manager and a written review date.
• There is one central reporting path, and people know what to report.
• Case files live in one controlled place with defined access and a retention schedule reviewed by counsel.
• Threat assessment, discipline, and suicide-risk screening are kept as separate processes. Maryland’s model requires this.²
• The team meets on a schedule to practice, not just when there is a case.⁴

For what the team does once a report arrives, see the three questions every threat assessment intake must answer and the steps in a school threat assessment. For the full framework, start with What Is a Behavioral Threat Assessment?

Frequently asked questions

Further reading from my books

Integrated BTAM includes a 90-day rollout plan that forms and charters the team in its first two weeks, and a sample one-page team charter covering composition, roles, and meeting protocol. The BTAM Case Workbook opens with “Build the Team,” with a Team Roster and Roles form, a Team Charter Checklist, and a 90-Day Launch Tracker, plus practice cases for training the team together. Free sample forms from the workbook are on the free BTAM forms page.

Sources

1. Michigan Compiled Laws § 380.1308e, “Behavior threat assessment and management team; duties” (2024 PA 272; team deadline Oct. 1, 2026)
2. Maryland Center for School Safety, “Behavior Threat Assessment in Schools Model Policy,” adopted by the Maryland School Safety Subcabinet, October 2026
3. Maryland Center for School Safety, “Behavioral Threat Assessment (BTA) for Maryland Schools” (local policy deadline Dec. 1, 2027), accessed Nov. 10, 2026
4. U.S. Secret Service National Threat Assessment Center, “Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence,” July 2018

This is general information and commentary, not legal advice. Requirements vary by state and setting; confirm your obligations with counsel. Facts are as stated in the sources above on the dates shown.