What Is Workplace Violence?
Workplace violence is any act or threat of physical violence, harassment, intimidation, or other threatening disruptive behavior that occurs at the work site. That is OSHA's definition, and it is deliberately broad. It runs from verbal abuse at the low end to homicide at the high end, and it covers conduct directed at or committed by employees, clients, customers, and visitors alike.
Why the Breadth of the Definition Matters
Most employers have a mental model of workplace violence that starts and stops at an active shooter. That model is both the rarest scenario and the most expensive one to control for, which is a bad combination for a prevention budget.
The practical consequence of OSHA's broader definition is that the incidents an organization is most likely to face are the ones already sitting in its HR files: escalating conflict between two employees, a customer who has become abusive toward front-line staff, a supervisor whose behavior has generated repeated complaints. Those are workplace violence matters under the federal definition, and they are also the events that most often precede something worse.
Violence, Harassment, and Threat: Where Programs Blur the Line
Harassment complaints usually route to HR. Security incidents usually route to facilities or corporate security. Threats fall in between and frequently route nowhere in particular.
That gap is where cases go quiet. A workable program defines which behaviors trigger which pathway, and names a single owner for cases that involve a threat rather than a policy violation. Without that, the organization ends up with two partial records of the same escalating situation and no one holding the whole file.
How Common Is Workplace Violence?
The Bureau of Labor Statistics recorded 470 workplace homicides in the United States in 2024, up from 458 in 2023. That increase occurred while total workplace fatalities fell 4 percent, from 5,283 to 5,070. Violence is one of the few fatality categories not improving.
Fatal Incidents
Violent acts accounted for 733 workplace deaths in 2024. Homicides made up 470 of those, with suicides accounting for the remaining 263. OSHA identifies acts of violence as the third-leading cause of fatal occupational injuries in the country.
The demographic split is worth noting for anyone designing a program. Women accounted for roughly eight percent of all workplace fatalities in 2024 but more than fifteen percent of workplace homicide victims, a disparity that points directly at the domestic violence category discussed below.
Nonfatal Incidents
Fatalities are the smallest part of the picture. According to NIOSH, more than 20,000 private-industry workers suffered trauma from nonfatal workplace violence serious enough to require days away from work in a single recent reporting year. Of those workers, roughly three-quarters worked in healthcare and social assistance, nearly three-quarters were women, and more than one in five needed 31 days or more to recover.
Why the Real Number Is Higher
None of these counts capture threats, intimidation, or verbal abuse, and none capture incidents that were never reported. The joint BJS, BLS, and NIOSH indicators report on workplace violence found an average annual rate of roughly eight violent crimes per 1,000 workers, and researchers consistently treat even that as an undercount.
For an employer, the underreporting problem cuts two ways. It means the internal incident log understates actual exposure. It also means that a sudden rise in reported incidents after a program launch is usually a sign the reporting channel is working, not a sign that violence increased.
Does OSHA Require a Workplace Violence Prevention Program?
No federal OSHA standard specifically requires a workplace violence prevention program. OSHA nevertheless cites employers for workplace violence hazards under the General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health Act.
This is the single most misunderstood point in the topic, and it is where most of the legal exposure sits.
The General Duty Clause
Section 5(a)(1) requires employers to provide a workplace free from recognized hazards that are causing or are likely to cause death or serious physical harm. Courts have interpreted the clause to mean an employer has a legal obligation to address conditions that either the employer or the industry recognizes as hazardous, where a feasible method of abatement exists. OSHA's enforcement page on workplace violence states the agency's position directly.
What "Recognized Hazard" Actually Means
Recognition is the hinge. An employer is generally treated as on notice when any of the following exist:
- A history of violent incidents at the site or within the company
- Threats that were reported, whether or not they were acted on
- Documented complaints sitting in HR or security files
- Operation in a sector where the hazard is well established in industry literature, which now includes healthcare, behavioral health, social services, late-night retail, education, and corrections
That last category matters more than employers expect. Once a hazard is recognized at the industry level, individual employers in that industry are effectively presumed to be on notice, whether or not they have had an incident of their own.
How OSHA Builds a Citation
OSHA Directive CPL 02-01-058, issued in January 2017, tells field inspectors how to scope a workplace violence inspection and structure a General Duty Clause citation. Inspectors look for four elements: that a hazard existed, that employees were exposed to it, that the employer or industry recognized it, and that a feasible and useful method of correcting it was available.
The operational takeaway is uncomfortable but clear. The most damaging document after an incident is rarely the incident report. It is the email from six months earlier that flagged the problem and went nowhere.
State Requirements Are Moving Faster Than Federal
Several states have moved ahead of federal OSHA with mandatory workplace violence prevention requirements, particularly in healthcare and retail. Employers operating in New Jersey and New York should review their obligations against evolving state law, which we cover in detail in our post on workplace violence prevention requirements for NJ and NY employers.
The Four Types of Workplace Violence
NIOSH classifies workplace violence into four types based on the relationship between the perpetrator and the workplace. The distinction is not academic. Each type responds to a different control set, which is why a single generic policy tends to underperform against all four.
Type I: Criminal Intent
The perpetrator has no legitimate relationship to the business or its employees. Violence occurs during the commission of a crime such as robbery, shoplifting, or trespass.
Controls are primarily physical and procedural: cash handling limits and drop safes, lighting and sightlines, access control, camera coverage, and staffing levels during high-risk hours. OSHA's recommendations for late-night retail establishments remain the clearest published guidance for this category.
Type II: Customer or Client Violence
Aggression from someone the business serves: a patient, customer, resident, student, or member of the public. This is the dominant category by volume and the driver of most nonfatal workplace violence injuries nationally.
Controls center on de-escalation training, staffing ratios, duress alarms, environmental design, and clear authority for employees to disengage. OSHA's guidelines for healthcare and social service workers are the reference document here and are routinely cited by inspectors as evidence of recognized hazards and feasible controls.
Type III: Worker-on-Worker Violence
Conflict or aggression between employees, supervisors, or coworkers. Controls are almost entirely administrative rather than physical: functioning reporting channels, defined HR escalation protocols, behavioral threat assessment capability, and disciplined separation procedures for high-risk terminations.
Type IV: Personal Relationship Violence
Violence that follows an employee into the workplace from their personal life, most commonly domestic violence. It disproportionately affects women, which the 2024 homicide demographics reflect.
Controls include confidential disclosure pathways that do not run through the employee's direct supervisor, support around protective orders, parking and schedule adjustments, photograph and description sharing with reception and security where legally appropriate, and workstation relocation away from public sightlines.
Why Most Programs Control for the Wrong Type
Organizations that invest in workplace violence prevention often buy hardware aimed at Type I and training aimed at active shooter response, then discover their actual exposure was Type III or Type IV the entire time.
The sequence matters. Assessment first, then spend. A program built without knowing which types the organization is actually exposed to will be expensive, visible, and misaligned.
Which Industries Face the Highest Risk?
Healthcare and social assistance workers absorb the largest share of nonfatal workplace violence, while sales, protective service, and transportation workers face the highest fatal risk. Exposure is not evenly distributed, and a defensible program can show why resources were pointed where they were.
Healthcare and Social Assistance
Roughly three-quarters of private-industry workers injured seriously enough by workplace violence to miss work come from healthcare and social assistance, at a rate several times the private-industry average. OSHA maintains a dedicated resource on preventing workplace violence in healthcare settings, and industry recognition of this hazard has been established since the 1990s.
Retail and Customer-Facing Roles
Retail and other customer-facing roles carry elevated fatal risk. A substantial share of workplace homicide victims were performing routine retail tasks, such as waiting on customers, at the time of the incident.
Isolated, Lone, and Late-Shift Workers
OSHA identifies several risk factors that raise exposure regardless of industry: exchanging money with the public, working alone or in small groups, working late at night or early morning, working in high-crime areas, delivering services inside private homes, and working with volatile or unstable individuals.
Any organization with employees who meet two or more of those conditions has a documented risk factor profile, and documented risk factors are exactly what establishes recognition.
What Are the Warning Signs of Workplace Violence?
Serious workplace violence rarely occurs without observable precursors. Common indicators include:
- Escalating verbal aggression, threats, or intimidation
- A pattern of conflict that HR or management has already addressed more than once
- Sudden, uncharacteristic changes in behavior, appearance, or reliability
- Comments referencing weapons, retaliation, or harming specific individuals
- A grievance narrative that hardens over time, particularly one that names a person rather than a policy
- Increasing isolation from colleagues, or a marked shift in workplace relationships
- Significant personal stressors such as a contested divorce, financial crisis, job loss, or substance use
Why a Checklist Is Not a Profile
Two cautions apply, and both matter legally as well as operationally.
First, no single indicator predicts violence. Treating the list above as a profile generates false positives that damage careers, invite discrimination and disability claims, and expose the organization to a different category of liability entirely. What matters is a pattern, a trajectory, and a change from that individual's baseline.
Second, the purpose of noticing is not to reach a conclusion. It is to trigger a structured process run by people trained to conduct one. That process is a behavioral threat assessment, and it is a defined discipline with its own methodology, not a management judgment call.
Reporting Culture Is the Real Control
Every warning sign above is only useful if someone reports it. Organizations that catch these situations early are the ones where employees believe a report will be taken seriously, acted on, and not held against them.
That belief is built long before it is needed, through visible follow-through on small reports. It cannot be created in the moment a serious one arrives.
How to Build a Workplace Violence Prevention Program
OSHA'sprevention program guidancetreats workplace violence like any other occupational hazard: assess it, write policy around it, train to it, control it, and verify that the controls work. A defensible program has five components plus one layer underneath all of them.
1. A Written Policy With Enforcement Mechanics
Zero tolerance stated in a handbook is a sentence, not a program. A usable policy defines prohibited conduct, covers employees, contractors, vendors, and visitors, names the reporting channels including at least one that bypasses the direct supervisor, and states what happens after a report is filed and who owns each step.
2. A Site-Specific Risk Assessment
Layout, operating hours, cash handling, public access, parking, staffing ratios, and prior incident history vary by location. A corporate-level assessment applied uniformly across all sites tends to miss the one facility that actually carries the exposure.
3. Training Matched to the Identified Risk
De-escalation for customer-facing staff. Situational awareness across the workforce. Recognition, documentation, and escalation for supervisors. Response protocols for everyone. Supervisors need the most training because they receive most of the early reports, and they are consistently the least-trained group in the organization.
4. Physical and Administrative Controls
Access control and visitor management, duress and alarm systems, camera coverage, lighting and sightlines, security staffing where the hazard profile warrants it, and administrative measures such as scheduling changes, parking reassignment, and workstation relocation for employees at elevated risk.
5. A Response and Recovery Plan
What happens in the first hour. Who notifies law enforcement and counsel. How employees are accounted for. How the incident is investigated and by whom. What support is offered afterward. How the business resumes operating.
Recovery planning is the component most often skipped and the one most visible to employees when it is missing.
The Documentation Layer
Underneath all five sits documentation. A program you cannot evidence is, from the perspective of a regulator or a plaintiff's counsel, a program that did not exist.
That means dated assessment reports, training rosters with signatures, incident logs with dispositions, and a record of what was recommended, what was implemented, what was deferred, and why. The "why" on deferred items is the entry that matters most and the one almost nobody writes down.
What Does a Workplace Violence Risk Assessment Include?
A workplace violence risk assessment is a documented evaluation of an organization's exposure, controls, and gaps, producing a prioritized remediation plan with named owners and dates. It is not a walkthrough with a clipboard.
A properly scoped assessment covers:
- Physical vulnerability review at each site, including access points, sightlines, lighting, parking, and reception configuration
- Review of prior incidents, threats, and complaint history across HR, security, and legal files
- Interviews with supervisors and front-line staff who see day-to-day conditions
- Evaluation of existing policy against the organization's actual hazard profile
- Training gap analysis by role
- Assessment of reporting channels and whether employees trust them
- A prioritized remediation plan with owners, dates, and cost estimates
The output serves two purposes at once. It reduces the likelihood of an incident, and it establishes a documented record that the organization identified its hazards and acted on them.
Frequently Asked Questions
Does OSHA have a workplace violence standard?
No. There is no federal OSHA standard specifically governing workplace violence. OSHA enforces workplace violence hazards through the General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health Act, which requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm. Several states have enacted their own mandatory requirements.
How many workplace homicides occur in the United States each year?
The Bureau of Labor Statistics recorded 470 workplace homicides in 2024, an increase from 458 in 2023. Homicides accounted for 470 of the 733 total workplace fatalities caused by violent acts that year.
What are the four types of workplace violence?
NIOSH classifies workplace violence into four types: Type I, criminal intent, where the perpetrator has no legitimate connection to the business; Type II, customer or client violence; Type III, worker-on-worker violence; and Type IV, personal relationship violence, most commonly domestic violence entering the workplace.
Which industry has the highest rate of workplace violence?
Healthcare and social assistance has the highest rate of nonfatal workplace violence, accounting for roughly three-quarters of private-industry workers injured seriously enough to miss work. Sales, protective service, and transportation occupations carry the highest fatal risk.
Is a zero-tolerance policy enough to satisfy OSHA?
No. OSHA compliance officers look for evidence that a program was operating and materially reducing a foreseeable hazard, not simply that a policy existed on paper. A policy without a risk assessment, training, controls, and documentation of follow-through does not establish abatement.
How often should a workplace violence risk assessment be updated?
Reassess annually at minimum, and immediately after any of the following: a violent incident or credible threat, a significant facility change, a merger or acquisition, a substantial change in operating hours or staffing model, or the opening of a new site.
The Bottom Line
Workplace violence prevention is not about assuming the worst of your employees or your customers. It is about identifying where the hazard actually sits, controlling it before it escalates, and being able to show your work.
The federal numbers are moving in the wrong direction while overall workplace fatalities improve. Employers who wait for an incident to build a program will be building it under the worst possible conditions: after the fact, in public, with counsel in the room and a regulator asking what was known and when.
Key Takeaways
- The absence of an OSHA workplace violence standard is not an absence of liability. Citations come through the General Duty Clause, and the trigger is prior recognition combined with a feasible fix that was not implemented.
- Industry-level recognition can put an employer on notice even without a prior incident of its own. Healthcare, behavioral health, social services, late-night retail, education, and corrections are all established categories.
- Prior complaints, HR files, and unanswered emails are what establish recognition. The record of what was reported and what was done about it is the core of any defensible position.
- The four NIOSH types require four different control sets. Hardware aimed at criminal intent does nothing for a worker-on-worker or domestic violence scenario.
- A rise in reported incidents after a program launch usually means the reporting channel started working, not that violence increased. Leadership should be briefed on that in advance.
- Supervisors receive most early warning signals and are usually the least-trained group in the organization. That gap is worth closing first.
- Documenting why a recommendation was deferred matters as much as documenting what was implemented.
Talk to Falcon Consulting Group
Falcon Consulting Group works with organizations to assess workplace violence risk, build prevention programs that stand up to scrutiny, and train teams to recognize and respond to warning signs before they become incidents.
Our investigative and advisory services are delivered by former federal and state law enforcement personnel, certified fraud examiners, and security professionals who have handled these matters from both the investigative and the corporate side. Where an incident involves financial misconduct alongside a threat, our financial investigations team works the two tracks together rather than sequentially.
If your organization has not evaluated its exposure recently, contact us to schedule a workplace violence risk assessment.
About the Author
Thomas W. Raftery III served 22 years as a Special Agent with the Federal Bureau of Investigation and was the first appointed Inspector General for the Delaware River Port Authority. He deployed to Afghanistan with the Special Inspector General for Afghanistan Reconstruction. He is a Certified Fraud Examiner and holds an MBA from Drexel University with a concentration in accounting. Learn more about the Falcon team.