A workplace violence risk assessment is not a compliance exercise completed after an alarming incident. It is essential for identifying where conflict, intimidation or targeted harm could occur, who may be exposed, and what controls will protect people without in a business, organisation or workplace without disrupting legitimate business or commercial activities.
For New Zealand businesses or organisations, the consequences of getting this wrong extend well beyond injury. A poorly managed threat can affect employee confidence, customer experience, continuity of operations, reputation and the ability of leaders to make sound decisions under pressure. The right assessment gives decision-makers a clear operational picture before a situation becomes critical.
What workplace violence actually looks like in New Zealand
Workplace violence in New Zealand is often incorrectly reduced to physical assault. In practice, it can include threats, stalking, intimidation, verbal abuse, harassment, property damage, aggressive behaviour, coercive conduct and credible threats made through email, social media or a third party. It may involve a customer, member of the public, employee, former employee, contractor, family member or someone targeting a particular individual.
The risk profile differs sharply between organisations. A retail team handling theft may face opportunistic aggression. A healthcare or social-services provider may manage distressed people, complex family dynamics and long wait times. Corporate offices can face insider disputes, grievance-driven behaviour or executive targeting. Construction sites, transport operations, public-facing government facilities and events each present their own access, crowd, isolation and response challenges.
This is why a generic form is rarely enough. An effective assessment considers the actual environment, work practices, people and threat history of each site.
Why a workplace violence risk assessment needs context
A meaningful assessment starts with evidence rather than assumptions. Incident records are useful, but they do not tell the whole story. Minor events are often under-reported, staff may normalise threatening behaviour, and a serious threat may emerge without any previous violence on the premises.
Assessors should examine the nature of the work, site layout, hours of operation, visitor access, cash or high-value assets, staffing levels, lone-worker exposure and any history of conflict. They should also consider external conditions such as nearby public disorder, high-risk tenancy issues, community tensions, contentious decisions or online attention directed at the business.
The central question is practical: where could a person become aggressive, how might that aggression escalate, and what would staff be able to do at that moment? A reception desk with unrestricted access presents a different risk from a secure corporate floor. A late-night venue with trained door staff has different control options from a remote service worker attending appointments alone.
Risk assessment should therefore be site-specific and role-specific. A single corporate policy may establish standards, but it cannot replace local intelligence and clear operating procedures.
Identify warning signs without making assumptions
Threat assessment requires judgement. Not every frustrated customer is dangerous, and treating ordinary dissatisfaction as a security incident can damage relationships. At the same time, dismissing repeated or escalating behaviours as “just part of the job” can leave staff exposed.
Warning signs should be assessed as patterns, not isolated labels. Relevant information may include repeated unwanted contact, fixation on a person or decision, threatening language, attempts to bypass security, hostility towards a particular employee, knowledge of private routines, violent statements, damage to property, or a marked escalation in frequency and intensity.
Context matters. A direct threat from a known individual with access to the site, a history of confrontation and a stated grievance requires a different response from an angry comment made in a crowded public setting. The aim is not to predict violence with false certainty. It is to recognise indicators early enough to apply proportionate controls.
Staff need a simple, trusted reporting route. If the process is unclear, overly bureaucratic or seen as punitive, valuable intelligence will remain with the person who experienced it. Leaders should make it clear that reports of intimidation, abuse and concerning conduct are operational information, not personal weakness.
Assess exposure, controls and response capability
Once hazards have been identified, assess who is exposed and when. This includes permanent staff, contractors, cleaners, delivery drivers, security personnel, visitors and customers. Pay close attention to people who work alone, open or close premises, handle complaints, enforce rules, deal with intoxicated people or travel between sites.
The assessment should test existing controls honestly. Cameras may assist investigation, but they do not stop a person reaching an unprotected receptionist. An access-control system has limited value if doors are routinely propped open. A duress alarm is only effective if someone receives the alert, understands the escalation protocol and can respond quickly.
Controls generally sit across several layers:
- physical measures such as controlled entry, secure reception design, lighting, safe rooms, CCTV and duress systems;
- operational measures including staffing levels, appointment protocols, visitor management, cash handling and clear escalation thresholds;
- people measures such as de-escalation training, communication standards, supervision and welfare support; and
- specialist measures, including threat assessment, protective security, investigation and intelligence-led monitoring where the risk warrants it.
No single measure is sufficient in every environment. A highly visible guard presence may deter opportunistic behaviour at a high-traffic site, while a discreet security posture may be more appropriate for an executive office, sensitive investigation or high-profile visitor. The control must match the threat, the setting and the need to preserve normal operations.
Build a response plan people can use under pressure
A risk register does not protect anyone if staff are unsure what to do when a situation develops. Response plans should be short, specific and practised. They need to define when a staff member should disengage, who contacts emergency services, who activates a duress alarm, where people move for safety, who takes command, and how information is shared without escalating panic.
For credible targeted threats, the plan may require tighter access management, changes to routines, security escorts, liaison with Police, welfare support for affected staff and careful handling of communications. In some cases, an investigation is needed to establish whether threats are connected, identify the source of harassment or preserve evidence for formal action.
Avoid relying solely on staff to manage volatile behaviour. De-escalation skills are valuable, but they are not a substitute for appropriate staffing, physical separation or trained security support. Asking an employee to continue engaging with an aggressive person because they are “good with people” is not a control measure.
Senior leaders should also nominate an incident decision-maker and a deputy. During a serious event, uncertainty about authority can delay protective action. A clear chain of command creates calm, accountability and better communication with emergency responders.
Review after incidents, changes and near misses
Risk is not static. A workplace violence risk assessment should be reviewed after a threat, confrontation, security breach, near miss or any material change to operations. New premises, altered opening hours, redundancies, high-profile decisions, public campaigns and changes to the client or customer mix can all alter exposure.
Post-incident reviews should be factual and constructive. Establish what happened, what information was available, whether controls operated as intended, and what needs to change. Do not focus only on the final incident. Often, earlier indicators were observed but not linked, escalated or documented.
This process should include support for affected people. Staff who have experienced threats or violence may need time away from frontline duties, practical safety planning, confidential wellbeing support and clear communication about what the organisation is doing next. A visible, competent response helps restore trust.
When security support is warranted
Internal teams can manage many lower-level risks when they have clear procedures and capable leadership. Specialist support becomes appropriate when a threat is targeted, persistent, complex or likely to attract public attention; when a site has repeated incidents; or when leaders need an independent assessment before making consequential decisions.
Experienced security and risk management specialists can combine site surveys, incident analysis, interviews, protective planning and discreet operational support. This is particularly valuable where security, human resources, legal considerations, public relations and business continuity intersect. The objective is not to create an unnecessarily heavy security footprint. It is to establish control with absolute precision.
TNG Security Limited, one of New Zealand’s leading high-level security, personal protection and risk management providers approaches business and workplace risk through sophisticated handling: vetted, New Zealand government (PSPLA) licensed personnel, intelligence-informed assessment and practical protective measures designed for the operating environment. For organisations in Auckland, Wellington, Christchurch or across New Zealand, that can mean the difference between reacting to disruption and managing it before it reaches the front door.
The strongest business or workplace is not the one that appears heavily guarded by security. It is the one where people know risks are recognised early, concerns are acted on professionally, and decisive security and protective services is immediately available when it matters most.
