Summary
In short
- Most workplace violence involves people with a relationship to the workplace: customers, clients, patients, colleagues, former employees and domestic partners, rather than strangers.
- Verbal aggression and threats are the highest-volume category and the leading indicator. Recording only physical events discards the warning signal.
- Under California Labor Code 6401.9, employers covered must maintain a violent incident log with defined fields, a written prevention plan and annual training.
- Record potential severity alongside outcome. An aggressive encounter that ended without contact and one that ended with a push differ by chance rather than by kind.
- Reporting depends on the person believing something will happen. Where verbal abuse is treated as part of the job, particularly in customer-facing and healthcare roles, reporting collapses.
- Aggregate by location, time and circumstance. Incidents cluster at specific counters, entrances, hours and interactions, and the pattern is a design finding.
What it is
What it is
What is a security incident report?
A record of any event involving threat, violence, aggression, intrusion, theft, tampering or breach of access control, capturing what occurred, who was involved, the response, and the potential severity alongside the actual outcome.
Does it cover verbal aggression?
It should. Verbal abuse, threats and intimidation are the highest-volume category and the leading indicator for physical events. Programmes that record only physical incidents have removed most of their data and all of their early warning.
When to use it
When to use it, and when not to
This records a security event. Investigation and the prevention plan sit alongside it.
Use it for
- Threats, verbal aggression, intimidation and physical violence, whoever is involved
- Intrusion, trespass, tampering and breach of access control
- Theft, including product, equipment, data and personal property
- Events involving former employees, domestic situations brought into the workplace, and customers or visitors
- Near misses, including situations that escalated and were defused
Not for
- The workplace violence prevention plan, which this record supports
- Investigation and root cause analysis for significant events
- Injury reporting, which follows where someone was hurt
- Human resources processes concerning employee conduct
- Information security incidents, which follow a separate regime
Standards
What it is built against
Workplace violence obligations are emerging in specific jurisdictions and otherwise sit under general duties.
| Clause | Requirement | Where it lands |
|---|---|---|
| California Labor Code 6401.9 | Workplace violence prevention plan, violent incident log with defined fields, training and record retention | Nature of the incident |
| Labor Code 6401.9(f) | Violent incident log recording date, time, location, type, circumstances and consequences | Event |
| OSHA General Duty Clause | US route for recognised workplace violence hazards absent a specific federal standard | Header |
| ISO 45001 cl.6.1.2 | Hazard identification including human factors and behaviour, and hazards from outside the organisation | Nature of the incident |
| ISO 45001 cl.8.2 | Emergency preparedness and response, including security scenarios | Response |
| ISO 45001 cl.10.2 | Incident investigation and corrective action | Follow up |
| ISO 45001 cl.5.4 | Worker consultation, required in developing violence prevention arrangements | Follow up |
| Privacy law | Personal data restrictions where incidents involve named individuals and health information | Severity and potential |
What it does not cover
- The workplace violence prevention plan, which this record supports.
- Investigation and root cause analysis, for significant events.
- Injury reporting, where someone was hurt.
- Human resources conduct processes, which run separately.
- Information security incident reporting, a separate regime.
Filling it in
Filling it in well
Capture verbal events, record the circumstances, and aggregate before drawing conclusions about people.
These are the highest-volume category and the leading indicator for physical violence. In customer-facing, healthcare and enforcement roles they are frequently regarded as an unavoidable feature of the work, which is exactly why they go unrecorded and why the escalation pattern is invisible until something physical happens.
What preceded it: a refused request, a delay, a decision communicated, an intoxicated person, a dispute over a bill, a dismissal. Circumstances are what make incidents preventable, because they identify the interactions that generate aggression and the ones that can be redesigned.
An encounter where someone was threatened and one where they were pushed frequently differ by chance rather than by anything either party controlled. Ranking by physical outcome systematically under-weights the events that came closest to serious harm, which is the same failure as in injury reporting.
Incidents concentrate at specific counters, entrances, times and transaction types. That clustering is a design finding: the layout of a reception, the position of a barrier, the lone hour before closing, the point at which a decision is communicated. It is invisible in individual reports and obvious in aggregate.
Audit findings
Common audit findings
Security findings concentrate on what gets reported and where events cluster.
| Finding | Clause | What fixes it |
|---|---|---|
| Only physical incidents recorded, with verbal aggression excluded. | Labor Code 6401.9(f) | Verbal events are the leading indicator and the largest category. |
| Programme built around perimeter security with no internal risk assessment. | ISO 45001 cl.6.1.2 | Most events involve people with legitimate access. |
| Circumstances preceding the event not recorded. | Labor Code 6401.9(f) | Circumstances identify the interactions that can be redesigned. |
| Potential severity not recorded. | ISO 45001 cl.10.2 | Threatened and pushed frequently differ by chance rather than by kind. |
| Domestic violence risk not addressed in the prevention plan. | ISO 45001 cl.6.1.2 | The workplace is a predictable location; perimeter measures address it least well. |
| Verbal abuse treated as part of the job in customer-facing roles. | ISO 45001 cl.5.4 | Where it is normalised, reporting collapses and the warning signal disappears. |
| No aggregation by location, time or interaction type. | ISO 45001 cl.9.1 | Clustering is the design finding; individual reports are noise. |
| Former employee access not removed promptly on departure. | ISO 45001 cl.8.2 | Access, keys, codes and credentials, on the day rather than in the next cycle. |
| Lone and out-of-hours workers not covered by the arrangements. | ISO 45001 cl.6.1.2 | They face the same events with the slowest response available. |
| No feedback to reporters, so reporting declines. | ISO 45001 cl.5.4 | Reporting persists only where people see something happen as a result. |
Worked case
Case in point: the counter and the hour
A service operation recorded security incidents when they involved physical contact or police attendance, which amounted to a handful a year. Verbal abuse was frequent and unrecorded, on the understanding that it came with the role.
A three-month trial recording every instance of aggression, including verbal, produced a different picture. Events concentrated overwhelmingly at one counter position, in the final ninety minutes before closing, and in a specific interaction: telling someone their request could not be completed that day.
Two changes followed. The cut-off for that request type moved earlier so the conversation happened when the area was staffed and calm, and the counter layout was altered to remove a position where a member of staff could be approached from two sides. Reported aggression at that point fell substantially.
Definitions
Definitions and key terms
- Workplace violence
- Acts or threats of physical violence, harassment, intimidation or threatening disruptive behaviour occurring at the workplace.
- Violent incident log
- The record required under California Labor Code 6401.9 with defined fields including circumstances and consequences.
- Type of violence
- Classification by relationship: criminal intent, customer or client, worker on worker, and personal relationship.
- Verbal aggression
- Threats, abuse and intimidation without physical contact, the highest-volume category and leading indicator.
- Circumstances
- What preceded the event, which identifies the interactions that generate aggression.
- Potential severity
- How serious the event could have been, recorded alongside the physical outcome.
- Prevention plan
- The written plan required in some jurisdictions, covering hazard identification, response, training and review.
- Clustering
- Concentration of incidents by location, time or interaction type, which converts events into design findings.
FAQ
Frequently asked questions
Where does workplace violence actually come from?+
Predominantly from people with a relationship to the workplace: customers, clients, patients, colleagues, former employees and domestic partners. Perimeter security, access control and visitor management are designed around a stranger gaining entry, which is the smallest of the categories and the one most heavily addressed.
Should verbal aggression be recorded?+
Yes, and it is the most important category to record. It is the highest-volume data and the leading indicator for physical events. In customer-facing, healthcare and enforcement roles it is frequently regarded as an unavoidable part of the work, which is precisely why it goes unrecorded and why escalation patterns are invisible until something physical occurs.
What does California require?+
Under Labor Code 6401.9, covered employers must maintain a written workplace violence prevention plan, keep a violent incident log recording date, time, location, type, circumstances and consequences, provide annual training, and retain records. It is currently the most prescriptive workplace violence requirement in the US and there is no equivalent federal standard.
Why record circumstances?+
Because they are what make incidents preventable. Knowing that an assault occurred tells you little; knowing it followed a refused request, a delay, a bill dispute or a decision being communicated identifies an interaction that can be redesigned, rescheduled or moved to a different setting.
What happens to reporting when we start recording verbal events?+
Reported figures rise sharply, usually in the first year, because a category previously treated as normal begins to appear. That needs explaining to leadership before the change rather than afterwards, since a rising security incident count looks like a deteriorating situation when it reflects a widening lens.
The agents
What the agents do with it
The report captures a security event. What fails is the verbal category nobody recorded and the counter nobody aggregated.
Captures verbal and physical events with circumstances and potential severity, and holds the violent incident log fields where required.
Aggregates by location, hour and interaction type, converting individual events into layout and scheduling findings.
Connects incidents to support for those involved, since psychological effects follow threats as well as contact.
Delivers de-escalation and response training targeted at the interactions the data shows generate aggression.
This template lives in KnowSafe — safety and compliance. Incidents, hazards, permits, inspections and the critical controls behind them.
Meet KnowSafe→Sources
Sources
- California Labor Code 6401.9, workplace violence prevention
- OSHA guidance on preventing workplace violence, including for healthcare and social service workers
- ISO 45001:2018 clauses 6.1.2, 8.2 and 10.2
- NIOSH occupational violence research and typology of workplace violence
- Cal/OSHA workplace violence prevention in general industry resources