Hostile Environment

Active shooting incidents are rare, random and unpredictable. Responders have 300 seconds – the estimated average duration of such an event – to address the situation. A lack of preparation can be the difference between life and death.

A standard definition for an active shooter is an individual actively engaged in killing or attempting to kill people in a confined and populated area.

Just like any loss exposure, an active shooting has to be defined and identified. But for this risk, the shooter is the catalyst and he or she has to be defined. In most cases, active shooters use firearms(s) and there is no pattern or method to their selection of victims.

There are some characteristics of the shooter profile: the majority are male; the average age is 35-44, though school shooters average 15 to19 years old; shooters have come from all races and ethnic backgrounds; most were single and not working with other shooters; many had an association or connection with either the targetted location or business, or one of the victims; and many shooters had told at least one person about their intentions or thoughts of violence.

In the majority of cases, the shooting event is over before law enforcement arrives to address the situation. In rural or even suburban areas, the response time may be greater. In addition, the most prevalent locations of shootings are businesses.

Many have occurred in retail stores, office complexes and warehouse settings. Schools and educational institutions are not immune from unpredictable and random acts of violence, but are not targetted by shooters as frequently as business premises. However, every institution, business, organization or event is susceptible to an active shooter.

Therefore, like any major catastrophic event that may not be predictable (a one in a 100 year event), the risk of an active shooter has to be addressed. As with other risks, the process of identification, analysis, control/mitigation, risk finance and monitoring need to be adhered to for the possibility of an active shooting event. Companies that employ full-time security and/or risk management staff are routinely trained in identifying risks, but other departments should be included. Facilities, engineering, operations, human resources, legal, communications and finance should be part of the discussion on identifying and evaluating where access points can be secured, how cameras should be used, distribution of personnel in the building, security personnel awareness, employee mental health programs and supervisor awareness of disgruntled employees. These are just a few of the identification factors that should be evaluated.

In the identification stage, businesses or institutions should not limit themselves to internal resources for identification. They should also consult external resources. Local law enforcement, emergency medical teams, landlords, outside professional security experts, insurance brokers and loss prevention personnel all can be beneficial in helping to identify exposures.

Canadian law – under provincial occupiers’ liability acts – generally stipulates that an occupier (owner, lessee, renter, etc.) must take reasonable steps to make sure that persons are safe while on their premises. This duty of care applies whether a danger or risk is caused by the condition of the premises or by an activity carried out on the premises. In most cases, a court would ask if an incident was foreseeable. If an incident was foreseeable, the question is then whether or not the occupier took action to identify, prevent or mitigate the potential risks. Insurance policies may or may not cover the losses, legal defence or resulting litigation that can possibly arise from an active shooter incident. Company risk managers and insurance professionals should review their policies for exclusions and endorsements that could deny or trigger coverage.

Once the identification phase has been completed, an analysis must be conducted to identify areas at greatest risk of a shooting. The use of a heat map or dashboard – which depicts the ranking of risks by high, medium and low probability – can help a risk manager determine where resources should be deployed and attention focused.

This type of analysis would lead to the third step of governing or mitigating an active shooting event. The same external and internal stakeholders who were consulted for the identification phase should be involved in advising an organization on how to control or prepare for an active shooter incident. Areas to consider should include, but not be limited, to the following:

• denying the shooter access to the

facility or buildings (at a minimum, make security access a priority);

• ensuring that threats or discussion of violent acts by employees or visitors are followed up immediately;

• reminding employees to report any suspicious individuals or activities and investigating these reports;

• ensuring security personnel are visible, equipped with two-way

electronic communications and well trained in protocols in active shooter events;

• training all employees on their roles in the event that an active shooter

enters the business campus;

• training employees on how to personally respond (for example, run, hide and shelter in place or fight) in the event of an active shooter;

• working with law enforcement to have an internal plan of action and staging location;

• installing a notification system in the facility; and

• developing a strategy on dealing with the media, the community, employees, non-employees and those affected by the shooting (for example,

hotlines, spokespeople, grief counselling or memorial services).

Police responding to an active shooter are likely to have specific expectations of innocent occupants, who should be advised to do the following:

• try to remain calm and clear-headed;

• keep their hands visible and have nothing in them;

• not run towards the police or in any way appear to present a threat;

• not carry any items, such as purses, backpacks or bags; and

• instantly comply with police instructions.

Occupants should also be aware that police are not likely to immediately attend to the injured.

The fourth step in the active shooter risk management process is risk finance. Insurance may well offer coverage, but that may not be enough. Has the firm set aside funds to pay for some expenses that could arise in the aftermath? These could include the following:

• repairs and cleaning;

• establishing a charitable trust or fund for victims and their families;

• costs related to vigils or memorials;

• increased security at the business;

• hiring and retraining employees;

• loss of revenue while the business is closed; and

• legal defence fees.

Some insurance carriers offer crisis response that could help offset some of these expenses.

Finally, monitoring the risk process for an active shooter event entails using a “what if” brainstorming session with senior management and departments that would be affected. Risk managers should consider conducting table-top exercises and unscheduled building evacuation drills. The process could even entail a live active shooter drill with the co-operation of local authorities.

Shooting incidents at companies and institutions in Canada are uncommon. But as recent incidents have shown, the probability of such an incident happening is not zero. As with any other potential peril or exposure, planning and preparation – via sound risk management and diligent security – may be the difference between life and death.