Risk Management and School Security

By Craig S. Gundry, PSP, cATO, CHS-III

When teaching security planning workshops for school leaders, I find it valuable to begin the presentation with a brief discussion to put the risk of school violence in perspective. I realize in most audiences there will be a few administrators who believe such an event could never happen in their school. Conversely, I also know there may be others present holding an exaggerated fear of the threat fueled by what they have seen in headlines over the past several years.

Fundamentally, preparation for active shooter violence is a process of risk management and conceptually no different from any other security and safety planning activity. The ultimate aim of any risk management program is to effectively characterize the risk to an organization’s assets and implement measures to reduce risk in alignment with the organization’s risk appetite while tending matters of operational needs, culture, branding, and budget.

There are two factors that contribute to risk: Probability (the probability of occurrence of a risk event) and Criticality (the impact/severity of the risk event). Statistically, acts of mass homicide in schools are very low in frequency and rarely does probability as a sole factor justify risk reduction. For instance, the FBI documented 52 active shooter attacks in the United States between 2000 and 2017 involving educational institutions.[1] [2] [3] Considering the presence of over 139,000 schools and post-secondary intuitions in the US, the estimated probability of an individual school experiencing an active shooter attack over the eighteen year reporting period is 0.0004.[4]

However, the low statistical probability of active shooter risk rarely matches with public perspective. For instance, in a 2018 survey by Center for the Study of Local Issues at Anne Arundel Community College, 61% of county residents polled expressed fear of a mass shooting in local schools.[5] According to the 2018 PDK Poll of the Public’s Attitudes Toward Public Schools, 34% of parents reported fear for their child’s safety at school.[6] In a 2018 survey of Whatcom County public school parents, school security tied with topics of student support services and access to career and technical education opportunities as number one priorities.[7] For independent schools, security is rapidly eclipsing traditional priorities of parents (such as scholastic excellence) and perception of safety has even become an issue of business competition.

Although the probability of mass violence is indeed very low, the threat is real nonetheless. To punctuate this point during seminars, I end discussion about risk probability with a slide displaying Florida State University’s Strozer Library and a short description of the shooting on 20 November 2014. I use that specific event as a sober example of the reality of active shooter violence because my second oldest daughter had just departed the library twenty minutes before gunman Myron May arrived and commenced fire.

For most schools, the probability of attack as a sole factor rarely justifies serious risk reduction. In most cases, it’s the potentially devastating consequences of an attack that warrant concern. Aside from the obvious and horrific impact of loss of life, active shooter attacks universally result in extended disruption of school operations, loss of student enrollments, and diversion of leadership attention to crisis management activities. The duration of disruption can extend months before police have released the school as a crime scene, cleanup and restoration is completed, and post-incident recovery activities have concluded.

An act of mass shooting can literally close the doors on a school forever. In cases where the horror of the event is deeply imprinted into the psyche of the public, the school may be deemed permanently inhabitable due to its presence as a reminder of the tragedy. Rather than repair and restore Sandy Hook Elementary School, Newtown Public Schools opted to demolish the building and build a new replacement school at an estimated cost of $50M.[9] Similarly, Florida’s Marjory Stoneman Douglas High School Public Safety Act authorized $25 million to replace building 12 in Parkland, Florida.

Depending the school’s responsiveness in managing the post-incident psychological consequences, the effects of an attack can easily result in exodus of students and school employees and long-term negative impact on climate and culture. In addition to psychological wounds suffered by the school population, the trauma of mass violence can extend far beyond the local community with measurable effects of sadness and anxiety experienced vicariously by people nationwide.[10]

When these issues are rationally understood from the perspective of risk management, it is usually the combined results of duty of care obligation (legal and moral responsibility for student safety), parental perceptions and expectations, and the potentially catastrophic consequences of an attack that warrant a balanced and diligent approach to risk control in schools.

Risk Management and School Violence

Effective security programs typically employ a combined approach to reducing risk probability and risk criticality. In the context of security risk, probability is the result of Threat (an adversary with intent and capability to cause harm) and Vulnerability (the state of conditions that would allow the adversary to succeed in causing the risk event). Proactive security measures aim to reduce Risk Probability by either reducing Threat or reducing Vulnerability. If proactive measures are implemented effectively, they may be successful in reducing Risk Probability, but there is always an element of uncertainty. To further reduce risk, reactive/mitigative measures are employed to reduce the harmful effect of risk events (Risk Criticality).

In protective theory, this concept of multiple layers of proactive and mitigative measures is often described as concentric rings of protection. This concept is illustrated in the following diagram. The outermost rings of the diagram (colored in blue) represent proactive measures aimed at reducing probability by reducing Threat and/or Vulnerability. However, despite our best effort to mitigate the probability of active shooter attacks, no strategy to prevent events can guarantee success with certainty. To address this reality, additional preparations should be implemented to reduce the severity of attack events. Additional mitigative and reactive countermeasures are represented by the innermost red layers in the diagram below.

Risk Management and Security Strategy for Schools

In the context of school security, proactive risk management starts with reducing potential threat. This is first accomplished by reducing the potential conditions that contribute to advancement on the targeted violence pathway. Reinforcement of positive school culture, creating strong bonds between staff and students, mentoring students with problems, actively intervening in bullying situations, and restorative practices are all examples of measures aimed at reducing threat. Additionally, as promoted by the US Government’s Safe School Initiative in 2001-2002, having a formal system in place to identify potential threats and warning behaviors, investigate and assess threats, and manage potential threatening situations before they result in violence is another critical element of reducing threat.

Schools need to be exceptionally attentive in the design of security programs to avoid negative impact on school climate and culture. In 2014, the National Association of School Psychologists strongly warned against the implementation of high profile security measures in schools due to its potential detrimental effect on school climate. We strongly agree with this position. High profile security measures and haphazard implementation can easily damage school climate and have a negative psychological effect on students. As stated by K.C. Poulin, the CEO of CIS, “If you make an environment feel like a prison, don’t be surprised when the community members feel and act like inmates.” Anything that suppresses positive school climate and culture is in direct conflict with our objective of proactively reducing threat.

To address this concern, school security programs need to be specifically engineered to create “invisible” layers of prevention and preparedness that are unnoticed by students. This low-profile approach should be consistent in all aspects of the program, from procedural design to physical security measures. If done properly, the most visible element of the program will be the School Resource Officers or security officers assigned to the school. To counter any negative impact of their presence, officers should be specifically selected and trained to develop relationships and positive rapport within the school community. Our company, Critical Intervention Services, uses a methodology called the Community and Character Based Protection Initiative (CCBPI) for this purpose. CCBPI is most simply described as an active and intentional process of developing relationships amongst the community as a means of engendering social capital and resolving conflict. Due to the CCBPI methodology and careful officer selection, officers in school should not only counter the negative effect of high profile security, but should be a powerful force for building and reinforcing positive school climate and culture.

Positive school culture and threat assessment may be effective in reducing the threat of students escalating toward violence, but these measures have little effect on outsider adversaries who may target the school for reasons beyond the school’s influence. The only way to effectively mitigate probability in this risk situation is to establish an effective physical protection system. Effective physical security requires that a threat is detected early and delayed from accomplishing the objective long enough for a response force to intercept. If these three elements (Detection, Delay, and Response) are deficient or out of synch, the system will fail. In virtually every school attack perpetrated by an outsider (e.g., Sandy Hook, West Nickel Mines, Platte River Canyon, etc.), there was a major failure in one or more of these three key functional elements. As of present, very few schools in the United States have a physical security program that truly meets the criteria for performance effectiveness.

If an attack does occur, additional measures should be implemented to mitigate the impact of the risk event. In school security, this starts by having a response force capable of effectively intercepting a threat before they can cause mass violence. If the effective response time of local police is longer than three minutes, it is usually impractical, if not impossible, to achieve enough delay time to prevent mass tragedy. Unfortunately, average police response times (effective response times) during active shooter events often range between 7 and 10 minutes (depending on cited source). The only way to guarantee an effective and reliable response is to have a reliable alert and communications system and an on-site response capability provided by School Resource Officers or well-trained armed security officers. For CIS Guardian SafeSchool Program clients in Florida, this function is facilitated by School Protection Officers that have been specifically selected and trained for this mission.

In addition to communications and tactical response, plans and preparations should be emplaced to manage the situation safely, effectively, and restore normal operations as quickly as possible. This starts with an effective and well-organized school emergency response plan. Despite the importance of having a solid and integrated emergency plan, this is one area where many schools have problems. School emergency plans are often a collection of memos with little integration or effective consideration to issues such as redundancy, feasibility under high stress conditions, and the many faces of “Murphy’s law” that emerge during crisis management.

Once the foundation is laid through effective response planning, teachers and faculty need to be trained in their functions and regularly drilled in response procedures. One of our clients, Shorecrest Preparatory School, conducts lockdown drills bi-monthly to ensure that teachers and staff members are instinctive in their response. When questioned about the frequency of lockdown drills versus legally-mandated fire drills, Mike Murphy (Headmaster at Shorecrest Prep) tells people that no kids have been killed in school fires in over 50 years but one only needs to watch this week’s news to be reminded of the last time school children were killed in an act of violence.

The Guardian SafeSchool Program® as a Model for Best Practices

The CIS Guardian SafeSchool Program® integrates all of these approaches to managing safety and security in schools while reinforcing school climate and culture. Our philosophy behind the design of the program is a holistic and multi-layered strategy that reduces risk by preventing acts of violence and mitigating the potential impact of events through effective preparation and response.

CIS is honored that John Jay College of Criminal Justice has peer reviewed the program and endorsed it as a model for best practices. It is our hope that states, school districts, and private schools will consider the methodology described in his article as they search for an effective and balanced solution to reducing risks of targeted violence while simultaneously fostering environments conducive to good education.

Share on facebook
Share on twitter
Share on linkedin
Share on email

Copyright © 2019 by Craig S. Gundry, PSP, cATO, CHS-III

CIS consultants offer a range of services to assist schools in managing risks of active shooter violence.  Contact us for more information.


[1] Blair, J. Pete, and Schweit, Katherine W. (2014). A Study of Active Shooter Incidents 2000-2013. Texas State University and Federal Bureau of Investigation, U.S. Department of Justice, Washington, D.C. 2014.

[2] Active Shooter Incidents in the United States in 2014 and 2015, Federal Bureau of Investigation, U.S. Department of Justice, Washington, D.C. 2016.

[3] Active Shooter Incidents in the United States in 2016 and 2017, Federal Bureau of Investigation, U.S. Department of Justice, Washington, D.C. 2018.

[4] U.S. Department of Education, National Center for Education Statistics. (2018). Digest of Education Statistics, 2016 (NCES 2017-094), Chapter 2.

[5] County Survey Finds Support for Gun Control, Concerns About Mass Shooting at Schools. Press Release: April 5, 2018. Center for the Study of Local Issues, Anne Arundel Community College.

[6] School security: Is your child safe at school? – PDK Poll 2018. http://pdkpoll.org/results/school-security-is-your-child-safe-at-school

[7] OSPI NEWS RELEASE: Counseling, Mental Health Top Priority, Public Says. Washington Office of Superintendent of Public Instruction. August 28, 2018.

[8] Tversky, Amos; Kahneman, Daniel (1973). “Availability: A heuristic for judging frequency and probability”. Cognitive Psychology. 5 (2): 207–232.

[9] Delgadillo, Natalie. With Shootings on the Rise, Schools Turn to ‘Active Shooter’ Insurance. http://www.governing.com/topics/education/gov-cost-of-active-shooters-insurance.html. June 2018.

[10] Dore, B., Ort, L., Braverman, O., & Ochsner, K. N. (2015). Sadness shifts to anxiety over time and distance from the national tragedy in Newtown, Connecticut. Psychological Science, 26(4), 363–373.