The Warning Was Reported. No One Owned It.

Here is the pattern that repeats across organizations of very different sizes. A supervisor hears something troubling. She does the right thing and reports it. Human Resources receives it and reads it as a personnel matter, because that is what Human Resources is built to read. Legal receives it and reads it as exposure, because that is the lens Legal is paid to apply. Security receives it and reads it as a request for additional coverage, because that is the tool Security has closest to hand.

Every one of those readings is defensible inside its own remit. Collectively they produce nothing. Three plausible owners is functionally identical to no owner, and the case drifts until it either resolves on its own or does not. The second cost is worse than the first. The supervisor learns that reporting went nowhere. That lesson is durable, it spreads informally, and it is far harder to undo than it was to cause.

Behavioral threat assessment is the structured evaluation of concerning behavior in context. It is not profiling. It is not prediction. It is not a disciplinary action taken in advance. It is a process for deciding what a concern actually warrants, and for putting that reasoning on the record.

This is the part that should encourage anyone building such a program inside a financial institution: you are not importing a foreign discipline. You are extending one the institution already runs with real rigor. Consider what happens when a suspicious transaction surfaces. Nobody convenes a meeting to debate who owns it. There is a defined intake channel, a triage standard, an escalation path with documented timelines, a retention requirement, and a named accountable person. The second line challenges the quality of the judgment. The third line provides independent assurance that the framework works as designed.

Examiners expect clearly documented processes, timelines, and accountability for identifying, reporting, investigating, and escalating incidents, and they will say so plainly when those are absent (FFIEC; OCC, 2019). That is precisely the governance a threat management program requires. Financial institutions have simply never pointed it at a person. They have pointed it at transactions, vendors, models, and systems, and left concerning human behavior to be handled by whoever happened to hear about it first.

One intake channel, not three. If an employee has to decide whether a concern belongs to Human Resources, Security, or their manager, the program has already outsourced its hardest judgment call to the least equipped person in the chain.

A standing team with a named decision owner. The ASIS International workplace violence prevention and intervention standard centers on a Threat Management Team responsible for receiving, triaging, investigating, and resolving reports of concerning behavior through a documented process (ASIS International, n.d.). Standing matters more than the roster. A team assembled after a report arrives is a meeting, not a capability.

A structured framework instead of instinct. Meloy and colleagues identified eight warning behaviors that evidence accelerating risk: pathway, fixation, identification, novel aggression, energy burst, leakage, directly communicated threat, and last resort. Subsequent research has found pathway, identification, and last resort to be the strongest discriminators between attackers and non-attackers (Meloy et al., 2012). A shared vocabulary raises the quality of the assessment and produces a file whose reasoning a regulator, a court, or a successor can follow.

Resolution that means managed, not closed. Administrative closure is an accounting act. It tells you the case left the queue. It tells you nothing about the person.

Most programs report reports received and cases opened. Those numbers describe the intake, not the program. Three measures tell you considerably more: how long from report to first assessment; what proportion of cases carry a documented decision owner; what proportion resolve with an active monitoring plan rather than a closure note.

One warning for whoever presents these to a risk committee: a functioning program raises reporting volume, often sharply, because people start believing that reports go somewhere. Say this out loud before it happens. Otherwise the first genuinely healthy quarter will be read as a deteriorating one.

There is one more pattern specific to this sector. The person of concern is sometimes also the subject of a fraud, conduct, or insider investigation. Two teams then hold two partial views of the same individual, on two timelines, under two case numbers, and neither is looking at the whole person. If threat management and corporate investigations do not share a case view, the institution is managing half of someone. The seam between those two functions is where the most consequential cases will fall, and it is worth closing before the next one arrives.