​Organizations affected by an active shooter event will face extraordinary challenges from the moment the first shot is fired. Even if the company is able to maintain business operations in the aftermath, the physical and emotional recovery can go on for months and years after the event. Besides reevaluating physical security measures, updating business continuity plans, and dealing with possible lawsuits, companies also have a responsibility toward their employees who have suffered severe emotional trauma. 

To recover from an active shooter event, restore business operations, and retain employees, experts say that business continuity planning, communication strategies, and personnel issues should be among the top priorities for organizations. In this article, experts discuss what security professionals can do in the aftermath of an incident to recover as quickly and effectively as possible.​

Business Response 

Business operations will be devastated by an active shooter situation, experts say. Access to the building, or at least the floors where the incident occurred, will be virtually impossible.  

“Law enforcement is going to lock down the building, and it may not be given back for many days,” says Dave Hunt, senior instructor at Kiernan Group Holdings, a consulting firm that assists companies in planning for and responding to active shooter events. “It depends entirely on the extent of the incident–how many injured, dead, how many bullets? Every single trajectory of every single bullet, every shell casing, is all going to be essentially recovered.” 

Communication. Having a well-prepared crisis communications plan in place before an incident is crucial, but executing that strategy is inevitably more difficult when faced with a real-life tragedy. Experts say that an organization needs to maintain open communication with various groups following an active shooter event.

Because news travels at lightning speed, any organization affected by an active shooter event can expect the media to pick up on it almost immediately. “When an incident occurs, local media, newspapers, and TV stations are going to hear about it and they’re going to descend on that campus or facility,” says Josh Sinai, principal analyst at Kiernan Group Holdings, “and this will happen within 30 minutes.”

Talking to the media and the public can be one in the same, says Hunt, and he recommends that companies put a message on their social accounts and websites, and have a skilled speaker to talk to the press. “The media is one avenue through which the public can be communicated to,” he says, “but today we can also communicate with the public directly via Twitter, websites–there are all kinds of different social media options.” 

Larry Barton, a crisis management consultant, echoes this sentiment: “Get to the media before they get to you.” He recommends that leadership have several preplanned responses to rely upon and modify, as needed. 

“This is where a company can really distinguish itself by being crisis-prepared. Have your frequently asked questions ready, and start filling in the blanks from the moment the incident occurs,” Barton says. “You can keep refining them, you can keep massaging them, but get them started.”

These communication techniques work in the case of any crisis, says Darryl Armstrong, crisis communications expert at Armstrong and Associates. For example, one of his clients, a company responsible for large cleanup jobs after natural disasters and other hazardous events, used prewritten statements for large-scale incidents to quickly communicate with the media. 

“On the front end, they sat down as a core team and had put together an extensive set of media holding statements,” he says. These holding statements are prewritten messages that refer to specific event types, such as active shooter, fire, or medical hazard, for example. The documents can be easily accessed and modified during a crisis, then quickly sent out to the media and the public. 

He adds that the company also took the time to think about “every single question imaginable” that could come up in a press conference for any given disaster. “There was not a single question in the press conference they were not prepared to handle,” Armstrong says. 

Stakeholders. Communicating with family members of employees, especially those who are killed or wounded, should be a priority for companies after an active shooter event. 

Barton, who helps clients prepare for and respond to active shooter and workplace violence events, tells Security Management that he recently worked for an industrial facility in Tennessee that lost three employees in a workplace shooting. Within an hour after the incident, the employer had contacted all the victims’ families. This should be a standard practice for any company that finds itself in a similar crisis, he says. 

“There is not an ounce of liability associated with being kind to a family after an active shooter event,” he notes. “We have to say to our legal colleagues in HR, ‘This is not about the handbook, this is about the Golden Rule. We have to do the right thing.’”

Small and family-owned businesses tend to handle these events with more empathy, making for a faster overall recovery, says Armstrong. “In the recovery phase, they make themselves available. They go out of their way to do what they can to help the victims’ families, and the communities rally around them,” he notes. 

He adds that universities are another sector that handle communicating with stakeholders well, given that there are usually guidance counselors and psychologists on staff. “Their crisis management teams typically include people who are interacting daily with students and parents, so they are able to empathize.” 

Barton adds that while social media makes a great tool for communicating with the public post-incident, the platform is not appropriate for informing family members of any details. “Shame on any company where an employee’s loss of life is shared with the family by Twitter. That has happened, it will continue to happen, and you must never allow that to happen on your watch.”

Organizations may consider using “dark websites” that go live in the event of an emergency. When someone types in the main URL for the organization, they are redirected to a ghost site that has the latest information available. Armstrong recommends that organizations set up these pages to have at least 10 times the bandwidth as their normal site to accommodate heavy traffic. ​

Recovery

A well-prepared organization can continue business operations in the event of a range of hazards, such as bad weather or a fire, and it can build off those same crisis continuity plans when recovering from an active shooter event. “This is one more threat that your organization should be preparing for to determine how you can continue operations,” Hunt says. 

Business operations. Hunt recommends identifying an off-site location where operations can take place while the building is still being evaluated by law enforcement or damage is being repaired. IT systems should be backed up so they can be accessed from anywhere. 

“You need redundancy for roles,” adds Sinai, who says that at least one additional person should be trained in each major position at an organization. That way if someone in a leadership role is killed or injured, their job function is not completely lost. 

Company leaders will still be addressing basic questions of business operations that could easily be overlooked in the aftermath of a tragedy. Barton notes that employees who survive an incident are still worried about their livelihood. “Besides asking who got hurt or was killed, the second thing is, ‘Are we going to be paid?’” he notes. “So we have to have our leadership rehearse and train on a wide variety of questions that will come up.”

As a benchmark for business recovery, Sinai cites the example of a beer distribution plant in Manchester, Connecticut, that suffered an active shooter event. On August 3, 2010, eight employees of Hartford Distributors were killed by another worker at the facility who was being escorted out of the building after resigning. “It was a small business, it didn’t have the resources of a big company,” Barton says. But this distributor reached out to surrounding companies for help. 

The beer distributor didn’t have a trained counselor on staff, so Manchester law enforcement contacted area businesses to get trauma counselors and ministers onsite. “Know the community resources that can be at your site within an hour after any catastrophe,” Barton says. 

An offsite location was being set up for business operations, but employees protested, saying they felt strongly about returning to the original facility as soon as possible. In the days following the shooting, 100 employees from other beer distribution plants in Connecticut, as well as in Rhode Island, came to assist the company in keeping business operations on track. A memorial service was held for the employees who lost their lives. The company president addressed workers on the front lawn, in front of a makeshift mem­orial, before they reopened their doors. 

Just two months after the tragedy, Hartford Distributors merged with another beer company, Franklin Distributors, forming a larger organization. “The shooting was a very tough thing for all of us to go through,” Jim Stack, president of the new business, said to the Hartford Business Journal in a January 2011 article. “It certainly slowed some things down for us in coming together, but it did not stop us.”

Emotional response. The trauma inflicted on those who survive an active shooter incident can be enormous, and experts say that businesses ought to prepare in advance to provide mental health assistance for affected employees. This will help businesses recovery more quickly by retaining experienced workers, and provide employees with the emotional help they need. 

Hunt cites the Navy Yard shooting in Washington, D.C., in September 2013, when a shooter killed 13 employees. He says that employees were shaken that an active shooter could breach a secure military installation. “People who were interviewed following that incident were asked, ‘Do you feel safe going back to work?’ and the answer was, ‘No, I don’t feel safe going back to work.’” Hunt notes. “So you have the potential of losing employees, which are your most valuable asset, as a result of this incident.” 

Employees may not show immediate signs of trauma–negative emotions could surface months later. “Depression and PTSD are rarely going to emerge in the first hour. Your body is still in shock,” Barton says.  

Experts stress the importance of employee assistance programs (EAPs), which are confidential and provide counseling, assessments, and referrals for workers with personal or work-related concerns. 

“In all 50 states you can mandate that an employee actually go to an EAP program if there was a critical incident,” Barton notes, though he doesn’t recommend it in every case. 

To order an employee to seek counseling, the worker must demonstrate tangible evidence that they may pose a risk of harming themselves or others, Barton says, such as mentioning suicide, a desire to hurt others, or talking about weapons. Employers may decide instead to have a sit-down with that worker and have them sign a letter acknowledging they made the remarks, but understand doing it again could result in termination. “EAP is not your human resources department, they are there to support your HR department,” he emphasizes. 

There will also be organizations indirectly affected by shootings. For example, Barton worked with one financial firm that had a worker lose a family member in a high-profile mass shooting. The other employees struggled with how to respond to him emotionally. The company asked Barton to hold a debriefing to address people’s concerns. 

“I heard it all,” Barton says. “Do you leave a card on the desk? Do you kind of ignore him and just look the other way? Do you come up and say, ‘I have no idea what you went through but my prayers are with you?’” Ultimately, he says you can expect a variety of emotions expressed by employees at businesses both directly and indirectly impacted by these events, including fear, sadness, and even anger. 

Outlook. Conducting an after-action report may be a good idea for organizations that have suffered an active shooter event, experts say. It not only helps evaluate what worked and what did not in response to an incident, but other practitioners can turn to these documents for their own planning. “It’s very important for a security officer to look at after-action reports and to get best practices out of it,” Sinai says. 

He cites the after-action report completed by the U.S. Fire Administration on Northern Illinois University (NIU) after a classroom shooting on campus in 2008. That tragedy left six people dead, including the perpetrator. 

The report cites that NIU had studied the official report on the Virginia Tech Shooting and was prepared for the tragedy that occurred in its own building just a year later. “The value of that report, their training, and their joint planning was apparent in the excellent response to Cole Hall,” the after-action report stated of the university. 

While organizations may recover from a business standpoint, there may be significant changes implemented afterwards. For example, the building that formerly housed Sandy Hook elementary was torn down, and a new facility was constructed at the same site. That building reopened in August of last year, nearly four years after the shooting. In the case of Virginia Tech, the classroom building where the second shootings took place was turned into a dormitory hall. 

Overall, Hunt says that while organizations can never fully prepare themselves for a tragedy, they can learn from even the worst of situations. “You’re going to identify a lot of areas that can be improved,” he says. “There’s never going to be a perfect plan or a perfect response.” 

​To read how the city of San Bernardino ​recovered from the 2015 holiday party shooting that killed 14 people, click here.​

 

Active Shooter Liability

​In the case of an active shooter, U.S. companies are liable for protecting their employees as in any workplace violence incident. Under the U.S. Occupational Safety and Health Act of 1970, every U.S. employer is required to “furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees.” U.S. state and local provinces may also have their own relevant laws.

Hunt says companies that suffer a shooting can expect lawsuits. “If a family member is killed or injured here, there’s a high likelihood there will be a lawsuit alleging that not enough was done to prevent the incident, or to protect them during the incident,” he says. The case of disabled workers can also come up. “Someone who is disabled may feel they weren’t appropriately accommodated,” a requirement under the U.S. Americans with Disabilities Act. 

Barton says he believes a little effort and communication goes a long way in helping reduce the severity of a lawsuit when employees are killed. “If you can, reach out to the family with the support of your legal department to simply say, ‘We are here for you,’” he notes.

In addition to advanced planning, organizations need to carefully document the steps they take in the aftermath to help their case “There’s going to be a lot of holes in there. But at least say, ‘Here are the steps that we did proactively take to try to manage the incident.’”​​ ​