Blog > Managing Suspicious Activity and Safety Threats at Work

Managing Suspicious Activity and Safety Threats at Work

Suspicious Activity and Safety Threats | eCompliance Central

WHS Risk & Reporting Culture

Managing Suspicious Activity and Safety Threats at Work

Suspicious activity and safety threats rarely announce themselves. Instead, they surface as small warning signs — an access breach, an aggressive interaction, a concern raised quietly and never recorded. This guide shows Australian organisations how to notice those signals early, report them properly and escalate them through a calm, documented process.

Last updated on July 2, 2026

Why Safety Threats Now Sit Inside WHS Compliance

Safety Has Moved Beyond the Physical Checklist

Workplace safety is no longer limited to slips, trips, manual handling and emergency exits. Increasingly, Australian organisations must recognise that risk can emerge through behaviour, access patterns, communication and reporting gaps long before a serious incident occurs.

For HR leaders, WHS managers, compliance officers and frontline supervisors, the challenge is not simply responding after something has gone wrong. Rather, it is building an approach that helps people notice concerns early and act on them appropriately.

The Compliance Risk Lives in the Grey Zone

Consider the visitor who seems out of place, the contractor entering restricted areas, or the team that quietly normalises aggressive customer interactions. Each situation sits in a grey zone where nobody is certain whether a concern is “serious enough” to report.

Consequently, many genuine risk signals never reach anyone with the authority to act. Workers talk informally, wait to see whether something happens again, and assume someone else has already raised it.

What Australian Law Expects

Under Australian WHS obligations, a PCBU must manage risks to health and safety so far as is reasonably practicable. Safe Work Australia also frames violence, aggression, traumatic events and poor support as psychosocial hazards that require active management.

In practice, this means threatening behaviour, unsafe access and escalating aggression are foreseeable hazards, not merely security or conduct issues. Officers, including directors, carry due diligence duties that depend on visible, documented systems.

Executive Summary

What this blog covers: How Australian organisations can manage suspicious activity and safety threats through WHS risk management, reporting culture and workplace behaviour standards.
Who it’s for: HR leaders, WHS managers, compliance officers, risk managers, L&D teams, directors, officers and frontline managers across Australian workplaces.
Key regulatory context: The WHS Act 2011, Model WHS Regulations and Safe Work Australia guidance on hazard identification, psychosocial hazards, emergency plans and PCBU duties.
The central risk: Treating suspicious activity as informal gossip rather than a foreseeable workplace hazard requiring reporting, escalation and documented control.
Primary action required: Build a practical framework that trains workers to identify warning signs, report concerns early and escalate proportionately through documented pathways.

Australian workplace team discussing suspicious activity and safety threats reporting procedures

Suspicious Activity and Safety Threats Are Risk Signals

A Working Definition for Compliance Teams

Suspicious activity and safety threats are observable behaviours, circumstances or patterns that may indicate a risk to people, property, information or operations. Importantly, they do not always involve immediate violence or confirmed criminal intent — in compliance terms, they are signals that require assessment.

What These Signals Look Like in Practice

A workplace does not need certainty before it takes reasonable steps to manage a potential concern. Safe Work Australia describes risk management as a step-by-step process: identify hazards, assess risks, control risks and review controls. That same logic applies directly to ambiguous behaviour.

In practice, suspicious activity may include:

A person repeatedly attempting to access restricted areas without authorisation.
Aggressive, threatening or intimidating communication directed at workers.
A customer or visitor behaving unpredictably or refusing to follow site procedures.
Contractors bypassing sign-in, induction or security requirements.
An online message or pattern of contact suggesting a possible safety issue.

Familiarity Blindness: The Invisible Risk

When a team sees the same unsafe behaviour often enough, it stops feeling like a risk. Staff may say, “That customer is always like that,” or “That person ignores the entry process every time.” Over time, normalisation turns early warning signs into background noise.

The consequence chain is predictable: ignored signal, delayed intervention, preventable escalation, governance exposure. Accordingly, practical training should help workers separate observation from judgement and give them shared language for reporting what they see.

Why Warning Signs Go Unreported

Fragmented Systems Hide the Pattern

Many organisations still treat safety threats as security issues only. However, a single threat may cut across physical safety, psychosocial risk, privacy, misconduct, customer aggression and emergency management. When these issues sit in disconnected systems, nobody sees the whole picture:

A worker reports that someone has been watching staff leave the premises.
Facilities logs an access breach at a side entrance.
HR receives a complaint about intimidating workplace behaviour.
IT detects unusual account access outside normal hours.

Reporting Culture Failure, Not Individual Failure

Individually, each of those issues may appear manageable. Together, they may indicate a pattern requiring intervention — yet a compliance framework must connect those signals without overreaching or breaching privacy.

If workers report concerns and nothing visible happens, they learn that reporting is pointless. Similarly, if managers improvise responses, the organisation loses consistency and trust.

Compliance professionals often call this space the “grey zone”: the point where a concern has not yet become a formal incident but is still relevant to WHS risk management. Grey-zone risks are where most preventable harm begins.

Common Grey-Zone Risks to Watch

Grey-zone concerns rarely meet the threshold for an emergency response, but they do meet the threshold for assessment. Typical examples include:

Repeated minor access breaches that everyone notices and nobody records.
Escalating customer aggression during closing shifts or peak periods.
Uncharacteristic behaviour from a worker following a conflict or grievance.
Staff quietly avoiding particular areas because of previous incidents.

Early intervention interrupts that escalation. In addition, it may involve checking facts, adjusting rosters, improving lighting, increasing supervisor presence or clarifying behavioural expectations before anyone is harmed.

Manager reviewing a workplace safety threat management escalation checklist with employees

The Legal Anchor: WHS Act 2011 and Prevention Duties

What the WHS Act 2011 Requires

The WHS Act 2011 and the Model WHS Regulations require a PCBU to manage foreseeable risks to health and safety so far as is reasonably practicable. For suspicious activity and safety threats, that duty is preventive rather than reactive — it applies before an incident, not only after one.

Safe Work Australia also states that workplaces under the model WHS laws must have an emergency plan that tells workers and visitors what to do in an emergency. Therefore, a safety threat response process should connect to that emergency planning system, not sit outside it.

Psychosocial Hazards and Regulator Scrutiny

Regulators such as SafeWork NSW and WorkSafe Victoria increasingly examine how organisations manage psychosocial hazards. Safe Work Australia identifies several hazards directly relevant to threat management:

Violence and aggression, whether from customers, visitors or other workers.
Bullying, harassment and interpersonal conflict.
Traumatic events or exposure to distressing material.
Remote or isolated work with poor support.
Poor organisational justice, including inconsistent responses to reports.

Crucially, PCBUs must eliminate psychosocial risks, or minimise them so far as is reasonably practicable where elimination is not possible. Threatening behaviour is therefore a potential WHS hazard, not merely a conduct issue.

Documentation as Evidence of Due Diligence

Documentation is not punishment or surveillance. Instead, it is evidence of risk management, consultation, decision-making and officer due diligence — the record of what was known, when it was known, and what the organisation did about it.

A documented report should capture what was observed, when it occurred, who was affected, what immediate controls applied, what escalation followed and what review is required. Notably, training completion records alone do not demonstrate a safe system of work.

Leadership Accountability Before a Threat Becomes Obvious

How Managers Should Receive a Report

Leadership capability is tested in the pre-incident stage, when signs are incomplete and workers are deciding whether speaking up is safe. A worker who says, “I’m worried about this person’s behaviour,” should never be met with “Are you sure?” as the first response. Instead, a strong compliance response follows a simple sequence:

Listen fully and record the observable facts without judgement.
Ask clarifying questions and assess whether anyone faces immediate danger.
Escalate through the agreed pathway rather than improvising a solution.
Communicate to the reporter what will happen next.

Fairness, Privacy and Non-Discrimination

Reporting suspicious activity must never become a licence for stereotyping or unfair treatment. Accordingly, training must make clear what a legitimate report looks like:

Reports describe observable conduct, environmental facts or specific safety concerns.
Assumptions about identity, race, religion, age, disability or background have no place in a report.
Information is shared only with those who genuinely need to know.
Managers avoid conclusions until assessment is complete.

The Cost of Managerial Hesitation

Managers often delay because they fear overreacting, embarrassing someone or creating conflict. Hesitation can be well-intentioned, yet it may leave workers exposed to a repeating risk.

The chain runs from hesitation to informal containment, to repeated exposure, to preventable harm, and finally to officer and governance scrutiny. Scenario-based training breaks that chain, because managers practise making proportionate decisions before real pressure arrives.

Early Intervention: The Core Control Most Systems Miss

From Informal Concern to Formal Control

Early intervention means treating an unresolved concern as a control point rather than a wait-and-see moment. It formalises the step between noticing something and responding to a full incident.

In compliance terms, this reframes suspicious behaviour management: the organisation acts on likelihood and potential harm, not on certainty. Proportionality keeps the response calm — assessment first, then controls matched to the actual risk.

Ultimately, early intervention is what separates a prepared workplace from a lucky one.

What Proportionate Early Intervention Looks Like

Not every concern requires emergency services, disciplinary action or a formal investigation. Depending on the assessment, proportionate responses may include:

Environmental controls such as improved lighting, access changes or sign-in enforcement.
Staffing adjustments, closer supervision or accompanied closing procedures.
Welfare checks, debriefing and referral to specialist support services.
Clarified behavioural expectations linked to the code of conduct.

Psychological Safety Keeps the Signal Flowing

Workers must believe they can raise concerns without ridicule, blame or the label of being dramatic. A workplace that punishes reporters loses its early warning data, while a workplace that turns every concern into an accusation loses trust.

The balance is disciplined, documented and respectful. Moreover, visible follow-up — even a brief “here is what happened with your report” — is what convinces workers the system genuinely works.

The eCompliance Central Safety Threat Response Framework

The eCompliance Central Safety Threat Response Framework gives organisations a practical pathway for identifying, reporting, escalating and reviewing safety concerns. It connects WHS obligations, reporting culture, incident management and behavioural compliance in one sequence people can actually follow under pressure.

A 10-Step Framework for Control

Observe the Signal

Record what was seen, heard or experienced. Facts come first — assumptions and labels based on personal characteristics stay out.

Assess Immediate Safety

Decide whether anyone faces immediate danger. Where an emergency exists, follow the emergency plan and contact emergency services.

Report Through Agreed Channels

Use the organisation’s reporting pathway, whether that is a manager, WHS representative, security contact or incident system.

Capture Minimum Documentation

Note the date, time, location, people affected, observable behaviour and immediate controls. Supporting evidence strengthens later review.

Triage the Risk Level

Rate the concern as low, medium, high or critical based on likelihood, potential harm, recurrence and vulnerability.

Apply Proportionate Controls

Match the response to the risk using the hierarchy of controls. Options range from access restrictions to supervision, training or specialist referral.

Support Affected Workers

Check welfare, provide information and reduce exposure where reasonably practicable. Connection to support services matters as much as containment.

Escalate Emerging Patterns

Review repeated reports, near misses and cross-functional data together. Patterns often reveal risks that single reports miss.

Review and Close the Loop

Confirm what was done and whether the controls worked. Policies, training and emergency plans may need updating as a result.

Learn Without Blame

Treat incidents and near misses as fuel for improving safe systems of work. Blame-free review protects the flow of future reports.

Embedding the Framework in Your Organisation

This pathway belongs in induction, refresher training, manager development and emergency planning. Customisation matters, because a hospital, retail site, warehouse and corporate office each face different threat scenarios — SCORM-ready modules from our Australian compliance course library can be tailored to your policies, language, sites and escalation structures.

The Consequences of “Not Serious Yet”

How the Risk Compounds

A poorly managed safety threat rarely stops at the first incident. Injury, psychological harm, workers’ compensation claims, regulatory attention, reputational damage and loss of trust in leadership can all flow from one ignored signal.

The failure typically compounds in a predictable sequence:

Uncontrolled exposure — workers repeatedly encounter aggression or unsafe access without clear controls, and foreseeable risks go unmanaged.
Documentation failure — leaders cannot show what was reported, assessed or controlled, and due diligence becomes difficult to demonstrate.
Cultural and governance damage — workers stop speaking up, responses become inconsistent, and officers lose visibility over emerging risks.

From Fearful to Prepared

The compliance goal is not a fearful workplace. Rather, it is a prepared one — a workplace that relies on clear expectations, practical training, early intervention and documented risk management instead of luck, memory or heroics.

Prepared organisations also give leaders sharper assurance questions: whether workers are reporting concerns, whether managers can triage them, and whether anyone reviews patterns after near misses.

Compliance Intelligence: Key Insights

Suspicious activity becomes a compliance risk when workers notice warning signs but do not know how to report them.

Early intervention is a WHS control because it reduces exposure before a safety threat escalates.

A reporting culture gives leaders visibility over weak signals that incident records often miss.

Documentation is evidence of risk management, not a substitute for practical control measures.

Managers need escalation pathways before pressure forces them to make decisions alone.

Safety threat management must rest on observable behaviour, not assumptions or stereotypes.

Emergency plans grow stronger when workers understand how suspicious activity connects to escalation.

Generic training produces weak recall when workers face real, ambiguous safety decisions.

Key Takeaways

Treat suspicious activity and safety threats as WHS risk signals that require assessment, not informal workplace gossip.
Train workers to report observable facts early, without exaggeration, assumptions or discriminatory framing.
Give managers a clear escalation pathway so responses stay consistent and proportionate.
Connect threat management to emergency plans, psychosocial risk controls and code of conduct expectations.
Document what was known, what was assessed, what controls applied and what review followed.
Customise training so scenarios reflect your actual sites, customer groups, access risks and reporting channels.
Review repeated low-level concerns, because patterns often reveal risks that single reports miss.

Frequently Asked Questions

Obligations and Accountability

What should Australian employers do when workers report suspicious activity at work?

Treat the report as a risk signal and assess it through the PCBU’s WHS and incident management process. First, check immediate safety; then document the observable facts and escalate through the agreed pathway. The response should stay proportionate, fair and evidence-based rather than assumption-driven. If the concern suggests immediate danger, follow the emergency plan and contact emergency services.

Are small businesses required to manage suspicious activity and safety threats?

Yes. Small businesses operating as PCBUs carry WHS obligations, although the response can be proportionate to the size, nature and risk profile of the operation. A small business rarely needs a security department; however, it does need clear reporting steps, emergency procedures and practical training. Simple systems are acceptable when people understand, use and review them.

Can managers be personally accountable for ignoring safety threat reports?

Managers and officers can hold duties under WHS frameworks, depending on their role and level of influence. A manager who dismisses repeated concerns without assessment may create organisational risk, particularly where workers remain exposed to harm. Good leadership means receiving reports seriously, documenting them and escalating where required. Ultimately, the test is not whether every concern proves correct, but whether the response was reasonable and systematic.

Culture, Training and Practical Response

What does good safety threat management look like in practice?

Good practice is calm, documented, proportionate and connected to existing WHS systems. Workers know what to report, managers know how to triage, and leaders review patterns across incidents and near misses. Crucially, the process avoids stereotyping and focuses on observable behaviour, access risks and worker safety. It also includes early intervention, support for affected workers and regular review of controls.

How does suspicious activity reporting connect to psychological safety?

Psychological safety allows workers to raise concerns before they become formal incidents. If people fear ridicule, blame or retaliation, they often stay silent until a risk escalates. By contrast, a strong culture encourages factual reporting and protects fairness for everyone involved. That combination strengthens workplace behaviour, employee wellbeing and the broader compliance framework.

Is training enough to meet WHS obligations around safety threats?

Training matters, but it cannot carry the duty alone. It must sit alongside policies, reporting systems, supervision, emergency plans, environmental controls and leadership review. Compliance training works best when it teaches practical behaviours people can apply under pressure. Accordingly, organisations should pair training with active risk management and seek qualified legal advice where specific legal questions arise.

About the Author

This comprehensive article was actively developed by the expert content team at eCompliance Central, under the highly skilled direction of Dr. Denise Meyerson. Dr. Meyerson is the successful founder, a PhD-qualified educator, and a leading learning innovation specialist boasting over 35 years of deep, practical experience in learning and development, strict compliance, and vocational education. She has consulted extensively for leading global organisations and currently remains a highly recognised authority on behaviour-based compliance training within the complex Australian context. We firmly help ambitious organisations meet their strict compliance obligations through highly customised, deeply engaging, SCORM-ready training modules. We proudly build these robust tools precisely around your specific policies, your unique people, and your actual, daily operational realities. Note: We are professional educators, absolutely not legal advisors. For specific legal advice tailored precisely to your exact situation, please consult a fully qualified legal professional.

Ready to Strengthen Your Reporting Culture?

If managing suspicious activity and safety threats sits on your compliance agenda, a customised, SCORM-ready module gives your team a practical starting point. We build training around your policies, your reporting channels and your operational realities — so people know exactly what to do when something does not feel right.

Explore Custom Compliance Solutions

Looking for a broader overview?
Read our definitive Australian Workplace Compliance Guide.