Dealing with Workplace Violence Tabletop Exercise
For Exercise Use Only
For Exercise Use Only
For Exercise Use Only
For Exercise Use Only: This exercise and all exercise-related
documents and discussions are intended FOR EXERCISE USE ONLY.
All documents should be safeguarded, handled, transmitted, and stored
in accordance with the appropriate security directives.
2
For Exercise Use Only
For Exercise Use Only
Opening Remarks
[Add name and title here]
3
For Exercise Use Only
For Exercise Use Only
Participants
 [List participants here]
4
For Exercise Use Only
For Exercise Use Only
Introductions
 Please state your name and organization.
 Please restate your name and organization when speaking.
5
For Exercise Use Only
For Exercise Use Only
Agenda [make changes as necessary]
 0800 – 0830: Registration
 0830: Welcome, Introductions and Guidelines
 0845: Objectives
 0855: Module 1
 0925: Break
 0935: Module 2
 1105: Module 3
 1205: Hot Wash
 1225: Closing Comments
 1230: End Exercise
6
For Exercise Use Only
For Exercise Use Only
Administration
 Classification Level: This exercise and all exercise-related
documents and discussions are unclassified and intended FOR
EXERCISE USE ONLY.
 Cell Phone Use: Please turn your phones off during the exercise. If
you need to make a call or check e-mail, please kindly move to the
lobby area.
 Materials: Situation Manual (SitMan), seating chart, participant
roster [add any other materials the facility may use]
 Safety & Evacuation
For Exercise Use Only
For Exercise Use Only
Exercise Summary
The Dealing with Workplace Violence Tabletop Exercise provides
owners and operators with a useful exercise planning template to
address and discuss gaps, issues, and concerns. The exercise allows
exercise participants the opportunity to address key issues through a
series of facilitated discussions. The focus of this exercise is on
preparedness; to increase effective information sharing and
coordination between the facility, first responders, and relevant
stakeholders.
8
For Exercise Use Only
For Exercise Use Only
Exercise Structure
 Module 1 – Pre-Incident Phase
Module 2 – Incident and Response Phase
Module 3 – Assessment Phase
 Each module will begin with a scenario key event update.
 Participants will then engage in issue-based discussions.
 Facilitator will manage time allotted to each discussion period.
 Participants are encouraged to use the Situation Manual as a reference.
10
For Exercise Use Only
For Exercise Use Only
Exercise Purpose
Exercise design objectives are focused on improving information
sharing, the understanding of incident management activities,
developing recommended actions, and procedural adjustments to
address potential problem areas in advance of a potential threat to the
facility, and in accordance with relevant plans and procedures.
11
For Exercise Use Only
For Exercise Use Only
Exercise Objectives (1 of 2)
1. Identify and evaluate plans for response and mitigation of potential
workplace violence.
2. Assess the roles and effectiveness of coordination between public safety
officials and owners/operators in reacting to an adversarial event in
accordance with existing plans and Standard Operating Procedures
(SOPs) (e.g. Site Security Plans, Emergency Action Plans, Emergency
Response Plans, Memorandums of Agreement, Memorandums of
Understanding).
3. Examine the effectiveness of overall emergency response procedures in
a no-notice adversarial event in regards to the Incident Command
System (ICS) and logistical coordination among on-scene authorities.
4. Examine and evaluate facility incident response plans (e.g. Site Security
Plans, Emergency Action Plans, Emergency Response Plans, or other
appropriate plans) used during an adversarial event.
12
For Exercise Use Only
For Exercise Use Only
Exercise Objectives (2 of 2)
5.
6.
7.
8.
Assess the methods and effectiveness of internal and external
communications during an adversarial event in accordance with
existing plans and SOPs.
Identify and evaluate response, mitigation, and recovery actions
associated with an adversarial event at the facility.
Review information and threat sharing procedures and challenges
between Federal, State, and local government to and from
owners/operators.
Identify gaps, redundancies, developmental activities, and best
practices in standard procedures in response to an adversarial
situation.
13
For Exercise Use Only
For Exercise Use Only
Scenario Questions
 Each module of the tabletop exercise will be followed by a facilitated
discussion utilizing a set of discussion questions related to the
module scenario.
 Module questions will focus on different elements of incident
management and provide a framework for discussion.
 Discussion questions in the Situation Manual are supplied as
catalysts. Participants are not required to answer every question, nor
are they meant to limit topics that can be discussed.
 Facilitator may ask additional, pertinent questions to stimulate further
discussions.
14
For Exercise Use Only
For Exercise Use Only
Exercise Guidelines
 Open, low-stress, no-fault environment.
 Non-attribution, “Chatham House” rule.
 Responses should be based on knowledge of your current plans,
capabilities (i.e. use only existing capabilities), and insights derived
from training.
 Decisions are not precedent setting and may not reflect an
organization’s final position on a given issue.
 Assume cooperation and support from other organizations.
 Problem-solving efforts should be the focus - issue identification is
not as valuable as suggestions and recommended actions.
 The situation updates, written material, and resources provided are
the basis for discussion.
15
For Exercise Use Only
For Exercise Use Only
Assumptions and Artificialities
 The scenario is plausible and events occur as they are presented.
 There is no “hidden agenda” nor any trick questions.
 All players receive information at the same time.
 The scenario for this exercise is artificial.
 Assume cooperation and support from other organizations.
 The actions of law enforcement need to be addressed and
understood, but are not the focus of this exercise.
16
For Exercise Use Only
For Exercise Use Only
Scenario Video
VIDEO LINK
17
For Exercise Use Only
For Exercise Use Only
Scenario: Module 1 (1 of 5)
Pre-Incident Phase
 0820: Several employees arrive at work and pull into the parking lot. A
disagreement begins between Mark and Sharon after Mark gets upset
because Sharon took a parking place he planned to use. Mark steps out
of the car and a verbal altercation ensues when Brian steps in to try to
calm Mark down. Mark eventually storms off, parks his car in a separate
parking spot, and quickly enters the building.
1. Should any action be taken by Sharon, Brian, or other
coworkers who witnessed this incident take place?
a. Are plans or procedures available to guide employees in their
actions/decisions?
2. Is there a system in place for reporting signs of potentially
aggressive/violent behavior in the workplace?
18
For Exercise Use Only
For Exercise Use Only
Scenario: Module 1 (2 of 5)
Pre-Incident Phase
 0945: Sharon and Brian are in the break room discussing the fact that
Mark seems to be disgruntled lately, while going through a divorce.
Mark’s boss, Angela, walks into the break room and asks Sharon if she is
alright, as she heard about the incident in the parking lot by others in the
office. Angela tells Sharon and Brian that she intends to speak with
Mark.
3. Being the supervisor, should Angela have spent more time with
Sharon or Brian regarding what took place that morning in the
parking lot or should she have asked additional questions about
the recent interactions with Mark?
a. Should Sharon and Brian have volunteered information about
Mark’s personal situation?
19
For Exercise Use Only
For Exercise Use Only
Scenario: Module 1 (3 of 5)
Pre-Incident Phase
 1050: Angela requests a meeting with Mark in her office. Angela informs
Mark that she heard about the incident in the parking lot and that she has
received consistent complaints from other employees regarding his
aggressive behavior. She also addresses ongoing issues with Mark’s
performance and informs him that he will be placed on a probationary
period. Angela tells Mark that his behavior will not be tolerated and that if
his work does not improve there could be serious consequences. The
discussion becomes heated when Mark abruptly ends the meeting, not
wishing to discuss anything further with his boss. Mark is visibly angry and
upset when he leaves Angela’s office.
4. At this point, what actions, if any, should Angela take after the
meeting that just took place with Mark in her office?
a. What response could have been applied toward reducing disruptive,
threatening, or potentially violent behaviors?
20
For Exercise Use Only
For Exercise Use Only
Scenario: Module 1 (4 of 5)
Pre-Incident Phase
5. Should Mark’s behavior be reported to security?
6. Did any of the actions taken by Angela potentially increase
workplace violence risk factors?
7. Are there counseling services available to employees who show
signs of stress or aggression/violence?
21
For Exercise Use Only
For Exercise Use Only
Scenario: Module 1 (5 of 5)
Pre-Incident Phase
 1105: Mark exits the building and walks out to the parking lot. He goes
to his car and retrieves a large, heavy, dark duffel bag out of the trunk,
throws it over his shoulder, and walks back toward the building.
8. Should Mark have been escorted after the heated confrontation
with his boss in which he left visibly upset?
a. If an escort is recommended, who would be sent to accompany
Mark?
9. Are facility/company policies adequate to deescalate this
from proceeding into a violent incident? Do amendments to
current procedures need to be considered to ensure safety
for workers?
22
For Exercise Use Only
For Exercise Use Only
Scenario: Module 2 (1 of 3)
Incident and Response Phase
1115: A telephone call is received by the local 911 operator from an
employee at the facility. In the midst of audible gunshots, the frantic caller
reports that there is a man, with what appears to be a gun, in the facility,
and two injured victims in the hallway. The caller also reports that the
apparent assailant seems to be moving throughout the office and is firing at
any employees in his path.
1117: Shortly after receiving the telephone call from the distressed
employee, the local 911 center notifies local and State law enforcement of
a potential active shooter incident occurring at the facility. In addition, a
message is broadcast to all surrounding law enforcement agencies to notify
them of the situation. The 911 center also contacts emergency medical
services. The 911 operators subsequently attempt to communicate with the
facility’s security personnel.
23
For Exercise Use Only
For Exercise Use Only
Scenario: Module 2 (2 of 3)
Incident and Response Phase
1120: The operations manager for the facility is reached and notified of the
incident by a facility employee. The local 911 center and facility security
are receiving additional telephone calls from individuals hearing gunshots.
1122: Local law enforcement and emergency medical services arrive at the
scene of the incident and request facility maps.
1123: Law enforcement officers onsite assemble a contact team and access
the facility. To secure the facility, they enter the building to search for the
assailant and any potential victims. Concurrently, other law enforcement
officers establish a command post to direct responding personnel.
Considerations are also being made to close nearby roads and request
businesses and residents in the immediate area to shelter-in-place until the
situation is contained.
24
For Exercise Use Only
For Exercise Use Only
Scenario: Module 2 (3 of 3)
Incident and Response Phase
1124: Additional gunshots are heard and law enforcement officers
direct evacuated facility personnel to a more secure location.
1126: Reports from employees who fled the facility indicate the
assailant is an employee, Mark Smith, and he is headed towards the
East side of the facility. Local news media arrive on scene to report the
incident. Additional emergency medical services and law enforcement
officers also arrive.
1133: Law enforcement informs facility personnel that the assailant has
been located with a self inflicted wound. Law enforcement continues to
conduct additional search and rescue missions of the facility and begin
evacuating remaining employees.
25
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (1 of 10)
1.
Do owners/operators have the necessary security capability to protect
personnel and the facility during an incident while waiting for law
enforcement to formally respond?
a. Do facility incident response plans (e.g. Site Security Plans, Emergency
Action Plans, Emergency Response Plans, or other appropriate plans)
contain protocol for properly responding to similar incidents described in
the module?
b. Have security personnel been trained to provide guidance to employees
for this type of incident?
c. Are employees trained for this type of emergency incident? Is emergency
contact information made available to the call desk? Do procedures exist
for sheltering-in-place versus evacuation?
d. If your facility has security personnel, are they clearly identifiable upon
arrival of law enforcement?
e. Do owners/operators have a notification system in place to warn
employees on and offsite during such an incident?
f. What instructions will be given to the employees (e.g., evacuation,
shelter-in-place, lockdown)?
26
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (2 of 10)
2. Does the facility maintain security technology that can assist law
enforcement in response efforts?
a. Can security personnel assist in locating victims and assailants via
closed-circuit television or similar capabilities?
b. Are there access control capabilities at the facility in order to
facilitate entry of first responders, prevent entry of visitors or
additional employees, and manage contractors on site?
c. Does the facility have the ability to remotely control access to
critical components or activate/deactivate card readers, including
the capability to deactivate a specific card?
d. Is there appropriate emergency lighting capability at the facility to
deal with a night time incident?
27
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (3 of 10)
3. Do State and local officials effectively coordinate to respond to an
incident at the facility?
a. Are the necessary Memorandums of Understanding (MOU) and
Memorandums of Agreement (MOA) in place for external
jurisdictions to assist in response efforts?
b. Do local, county, and State law enforcement have incident
response plans (e.g. Site Security Plans, Emergency Action Plans,
Emergency Response Plans, or other appropriate plans) for an
active shooter situation? If so, who leads the response?
c. What would State and local officials need from owners/operators
during an incident similar to that detailed in this module?
28
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (4 of 10)
4. How is an emergency response coordinated?
a. Are any of the facility’s incident response plans (e.g. Site Security
Plans, Emergency Action Plans, Emergency Response Plans, or
other appropriate plans) regularly provided to first responders in
preparation for potential incidents?
b. Upon arrival of law enforcement, is there a “go bag” available to
them containing desired items such as facility map/floor plans,
access swipe cards, elevator keys, etc?
c. Are there any safety concerns that need to be addressed (e.g.,
entering restricted or hazardous areas)?
d. How do emergency response personnel access the buildings?
e. Have local law enforcement/first responders participated in
exercises and/or training at the facility?
29
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (5 of 10)
5. How is emergency communication handled?
a. Are critical telephone calls getting through? If not, is an alternate
means of communication available?
b. How will owners/operators interact with media representatives and
control media access to the facility?
c. Are there procedures in place to manage the media if they arrive?
d. Should additional emergency announcements be made to the
public? If so, by whom?
30
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (6 of 10)
6. Do the facility’s incident response plans cover emergency
coordination activities described in the module?
a. How is response coordinated and who maintains decisionmaking authority when facility management is not available?
b. Is delegation of authority captured in the security plan?
c. If doors to critical facility components are locked, how does law
enforcement obtain access?
d. Is there a safe location identified for personnel who are
evacuating the immediate area?
31
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (7 of 10)
7. What are the local law enforcement’s policies and procedures
regarding active shooter incidents?
a. What personnel resources do they have available to handle the
situation and establish a secure perimeter?
8. In what manner will command and control of the situation be
established in order to comply with the Incident Command
System?
32
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (8 of 10)
9. Do owners/operators have a sufficient existing security capability to
protect staff and the facility during an emergency?
a. Is there a way to account for employees (i.e., those who reported
for work that day versus those on leave)?
b. How is media access to the facility and staging areas managed?
c. What access control is or should be in place?
d. What are the procedures for safely securing any critical component
or operation of the facility?
e. What other life safety issues should be considered?
33
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (9 of 10)
10. Does the facility have physical security measures that may be
relevant to this scenario?
a. What types of perimeter security does this facility have (e.g.,
fences, doors, gates)?
b. What type of vehicle control checkpoints are present (e.g., barriers,
driveways, parking lots)?
c. Does the public have access to the facility?
34
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 2 (10 of 10)
11. How does law enforcement determine that the scene is cleared and
there are no additional shooters?
a. Once an all clear is given, how is that information communicated
to all personnel sheltered-in-place?
12. For a prolonged incident with a known assailant, law enforcement
will need as much information on the assailant as soon as possible.
Can that information be provided if law enforcement requests it?
35
For Exercise Use Only
For Exercise Use Only
Scenario: Module 3 (1 of 3)
Module 3: Assessment Phase
 1145: Law enforcement informs facility personnel that there are no
additional assailants. Law enforcement also reports approximately four
additional fatalities and eight wounded. Law enforcement announces
that they are going to initiate a controlled employee evacuation for all
remaining employees. At this time, the incident commander provides a
statement to all personnel and the public informing them of the
conclusion of the incident.
 1150: Law enforcement notifies facility owners/operators that the
facility is a crime scene until further notice.
36
For Exercise Use Only
For Exercise Use Only
Scenario: Module 3 (2 of 3)
Module 3: Assessment Phase
 1155: Emergency medical services enter the facility and reports that
there are currently five fatalities and seven wounded. The wounded are
being transported to a local hospital—the extent of the injuries are
unknown. This information is relayed to the facility’s emergency
coordinator. Neighboring facilities are notified that the facility has
been secured.
 1205: Emergency medical services relay information to law
enforcement and facility personnel that all seven gunshot victims are in
critical condition. Law enforcement is asking the facility and
personnel for help in identifying three of the injured individuals. The
remaining four have been identified through personal identification
cards.
37
For Exercise Use Only
For Exercise Use Only
Scenario: Module 3 (3 of 3)
Module 3: Assessment Phase
1235: The names of the five deceased victims are provided to the
facility owners/operators. Law enforcement is evacuating the facility on
an area-by-area basis. Security personnel are excluded from this
evacuation and will remain onsite to provide support, as necessary.
1300: Family notification of the deceased and injured begin.
1330: Law enforcement reminds the facility owners/operators that the
facility is a crime scene and that it will take an undetermined amount of
time to process the scene.
1350: The facility releases an official media statement about the
incident.
38
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 3 (1 of 4)
1. Do current security plans sufficiently address coordination of
emergency response personnel?
a. What does the facility emergency coordinator need to consider
(e.g., casualties, evacuation routes, hospitals)?
b. Where are the pre-determined locations of the facility command
post and staging area(s)?
c. Is there a process to assist law enforcement with victim
identification?
39
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 3 (2 of 4)
2. What information sharing mechanisms are in place that could be
relevant for an incident such as the one described in this
scenario?
a. Would owners/operators be able to share information in order
to pass pertinent information to help prevent potential attacks at
other facilities?
b. Would owners/operators be able to relay information to
Federal, State, and local authorities, including Fusion Centers?
c. Would owners/operators be able to receive information from
their Federal, State, and local officials, including Fusion
Centers?
d. Would owners/operators share information with families of
employees in order to keep them apprised of the situation?
40
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 3 (3 of 4)
3. How will personnel accountability and communication be
coordinated?
a. Who makes a list of the evacuees?
b. How do employees leave when the employee parking lot is a
crime scene and cannot be accessed?
c. How is information communicated with personnel and families
during the days following the incident?
d. Will counseling for employees and family members be available?
4. How can owners/operators prepare to handle the public
messaging/media in the aftermath of such an occurrence?
41
For Exercise Use Only
For Exercise Use Only
Scenario Questions: Module 3 (4 of 4)
5. How will law enforcement coordinate the future handling of the
facility as an active crime scene?
a. How will law enforcement communicate status with
owners/operators?
b. How will the facility work with this impediment?
c. Will law enforcement be able to estimate the duration the facility
will be considered a crime scene?
6. How will the ramifications of such an event be addressed in regards
to business continuity planning or rapid recovery operations?
a. Does the facility have a continuity of operations plan in place?
b. Will owners/operators face liability issues?
42
For Exercise Use Only
For Exercise Use Only
Hot Wash
1. Review exercise objectives and assess their accomplishment.
2. What are the identified issues we need to take for immediate
action?
3. What are other key issues we need to consider and review?
4. What did you get out of this exercise?
5. What are our next steps for addressing any issues that arose during
the exercise?
6. If there were any major issues, do we start a working group to
address them? If yes, who would participate in this group?
43
For Exercise Use Only
For Exercise Use Only
Closing Remarks
[Add name and title here]
For Exercise Use Only
For Exercise Use Only
Thank you
For Exercise Use Only