He Came Back at 14:30
You are the contract officer at a three-story customer-service center. At 10:05, HR terminates a six-year employee for time fraud in a closed office; he leaves calmly. At 14:30 he returns in his personal vehicle, parks in the visitor row facing the main entrance, and sits in the car with the engine running for 25 minutes. A supervisor who walked past says he told her, "They'll regret how they did me," then asked whether a specific team lead was still inside. No weapon is visible, there is no restraining order, and he has no history of violence on record. He is not on the property's trespass list. Forty employees are inside; shift ends at 16:00.
1. Assess the risk. What indicators move this up or down, and what would make it a 911 call rather than a watch-and-document situation?
Read the worked answer
This is a threat-assessment judgment, not a threat-detection one. No single indicator is decisive; the pattern is.
Elevating factors present:
- Recent, humiliating loss - termination for cause, same day, so the emotional event is hours old.
- Return to the site. Coming back is a choice that costs effort. Most terminated employees never return.
- Target identification - he asked about a specific team lead. That's the single most significant fact here; grievance plus a named person is the classic pre-incident pattern.
- Surveillance posture - parked facing the entrance, engine running, 25 minutes. That's watching and staying mobile.
- Statement - "They'll regret how they did me" is not a threat, but it is grievance language, and grievance language plus target identification plus proximity is exactly what threat assessments are for.
Lowering factors: no weapon seen, no violence history, no restraining order, calm exit at 10:05, no explicit threat.
What pushes this to 911: any weapon seen or gestured at, any attempt to enter, approaching an employee, attempting to get someone to come out, ramming or blocking a vehicle, revving or aggressive driving, or any escalation in speech. What keeps it at watch-and-document: he sits, leaves, or drives off when asked. The threshold is behavior toward people or the building, not the discomfort he creates by being there.
2. What do you do in the next 30 minutes - who do you tell, and do you approach the car?
Read the worked answer
Sequence:
- From a safe position, establish eyes-on and keep it. Radio or phone, not a walk-up. Note plate, make/model, exact position, time first seen.
- Notify now, not at end of shift. Your supervisor, the facilities/HR lead who handled the termination, and the named team lead's manager. Tell them the specific facts - the 14:30 return, the statement, the question about the team lead - not "he seems off." The team lead should be told quietly and given the option to leave by a different door at 16:00.
- Do not approach the car alone. He is not trespassed, is parked in a visitor row, and has broken no law. A lone officer walking up to a terminated employee's driver's window creates the confrontation you're trying to prevent and gives him a focus for his grievance. If the site decides he must leave, that decision should come from the client, with a witness and a second officer present, and the message should be neutral: the visit is over, please leave.
- Call police non-emergency to report a suspicious person/vehicle with the context; ask whether a unit can do a pass. Many departments will, and a marked car passing often resolves the situation without anyone approaching.
- Prepare the building: know which doors are controlled, alert the front desk, and have the 16:00 shift-change plan in hand.
Do not tell employees to confront him, post about it in a group chat, or spread the termination details - rumor is an accelerant.
3. At 16:00 he is still there and employees are leaving. What is the plan, and what do you write down?
Read the worked answer
The 16:00 plan - decided before 16:00, not at the door:
- Release people away from him. Use the side or rear exit for the team lead and for anyone uncomfortable; stagger departures; walk people to cars in pairs or escort them. This is the highest-value action of the whole day and costs nothing.
- Keep an officer between the crowd and the vehicle - visible, calm, at a distance. Presence changes behavior; proximity changes it badly.
- Update the police to the current state: still on site, employees now exiting. If he steps out of the car toward anyone, that is the 911 call, immediately, with his description and location.
- Have the client decide on the trespass. If the property owner wants him off the property, that's their call to make, and it should be delivered with two staff present and documented in writing once he's gone.
- Escalate if anything changes: approach, following a vehicle, photographing employees, returning after leaving.
What to document: time he arrived, parking position, engine state, duration, the exact words reported and who reported them, the question about the team lead, who you notified and when, police contact and reference number, all actions taken at shift change, and time he left. Write quotes verbatim and attribute them - "supervisor X stated he said..." - never "he threatened staff." Your report may be read by HR, police, or a court, and its accuracy is what makes the earlier caution defensible.