Threat Assessment Teams That Actually Work

Both Illinois Public Act 101-0455 and Missouri Senate Bill 68 require schools to stand up threat assessment teams. The roster is the easy part. Composition alone has never prevented an incident. What separates a team that intercepts a developing threat from a team that exists on paper is the operating rhythm, the data discipline, and the decision authority. That is the part the statutes do not write for you.

Illinois Public Act 101-0455 mandates that every public school district establish a threat assessment team and a corresponding procedure. The statute names the disciplines that must be represented: an administrator, a teacher, a school counselor, a school psychologist, a school social worker, and a representative of local law enforcement. Missouri SB 68 takes a similar approach, requiring multidisciplinary teams as part of the broader safety compliance framework that schools must have in place by July 1, 2026.

The two laws share an underlying logic. A threat is rarely visible from any single seat. The teacher sees behavioral drift in the classroom. The counselor sees the social context. The psychologist sees the clinical signal. The school resource officer sees the criminal history and external risk factors. Each of those lenses on its own is incomplete. Together they form a picture. That is why the composition is mandated.

Most schools we have audited can produce a team roster. Many of them cannot produce minutes from the last three meetings. Some cannot tell you when the team last met. A team that exists on a chart but does not operate as a team is not a threat assessment team. It is a list.

The failure mode is predictable. The roster gets approved at a board meeting. The members get an email. There is no standing meeting cadence, no defined data feed, no escalation protocol, and no decision authority articulated in writing. When a concerning incident happens, somebody pulls the team together for the first time in months, and the team has to invent its operating procedure on the day it is most under pressure. That is not how a functioning safety system works.

A team that prevents incidents has four operational elements in place before anything alarming happens.

• Meeting Cadence: The team meets on a published schedule, typically monthly during the school year, with the authority to convene within 24 hours on a flagged case. Standing meetings are not optional. They build the working relationships the team relies on under pressure.
• Data Review: Each meeting reviews a defined data feed: discipline referrals, attendance anomalies, counselor flags, tip-line submissions, social media intelligence, and any open cases from the prior meeting. The data is reviewed even when nothing appears urgent. The pattern detection is the value.
• Decision Authority: The team has documented authority to recommend specific actions: behavioral intervention, mental health referral, threat management plan, law enforcement notification, or change in school setting. The authority is explicit, the recommendations are recorded, and the implementation is tracked.
• Escalation Paths: When a case meets criteria for elevated risk, there is a written escalation protocol: who notifies the superintendent, who notifies law enforcement, who notifies the family, and on what timeline. The escalation path is decided in advance, not invented in the moment.

The most common failure is treating the team as reactive. The team gets called in only when something has already happened. By that point, the team is doing incident response, not threat assessment. The two are different functions.

The second common failure is fragmented data. The counselor knows one thing, the dean of students knows another, the SRO knows a third, and nobody is putting the picture together until after the incident. A functioning team has a structured intake process: every concerning signal lands in a shared review queue, gets reviewed at the next meeting, and triggers a decision (close, monitor, intervene, escalate). The decision is logged.

The third failure is authority confusion. The team meets, discusses, and produces recommendations that nobody is required to act on. Without clear connection between the team's recommendations and the school's operational response, the team becomes advisory in the worst sense: it advises, and nothing happens.

If you administer a school in either state, the diagnostic is straightforward. Pull the last six months of team activity and check the following:

• Cadence: Did the team meet on a published schedule, or did it meet only in response to incidents?
• Documentation: Are there minutes that show what data was reviewed, what cases were discussed, what decisions were made, and what follow-up was tracked?
• Data Feeds: Is there a structured intake for concerning signals from staff, students, parents, and external sources, and is that intake actually being reviewed?
• Authority: Is the team's decision authority documented, and are recommendations being implemented and tracked?
• Escalation: Is there a written escalation protocol with names, roles, and timelines?

If any of those answers is "no" or "we are working on it," the team is at risk of failing the next time it matters. That is the gap to close before an incident makes the gap visible publicly.

Public Act 101-0455 and SB 68 give you the floor. They tell you who must be at the table. What they do not tell you is how that table operates when nobody is looking. The schools that prevent incidents are the ones that built the operating rhythm before the law required them to, and the schools that experience incidents are often the ones whose teams existed only on paper.

The work is not glamorous. It is meeting agendas, intake forms, data dashboards, and minutes. Done consistently, that infrastructure is what holds when the situation is real.