How to Set a Follow-Up Review Date for a Workplace Threat Case

A follow-up review date is one of the most consequential fields in a workplace threat case file, and one of the least examined. Teams spend hours debating whether a concern is credible and minutes deciding when to look again. That ordering is backwards. The review date determines how long a possibly dangerous situation can run without a fresh look, and it determines how long a possibly harmless situation keeps consuming investigator time and damaging the employee's standing.

This guide covers how to set review timing based on risk, how to handle disagreement when you use multiple AI models as part of your assessment workflow, and how to document the decision so it holds up under scrutiny. It is written for HR business partners, security leads, legal reviewers, and the product and governance people who build the systems these teams use.

Start with the decision, not the calendar

Every review date answers one question: what would we need to learn before we make the next decision, and when could we realistically learn it? If you cannot name the decision, you are setting a date for comfort, not for risk control.

Before you pick a date, write down three things in the case record:

The named decision-maker who owns the next action. Not a team. A person with a name and a role.
The decision that person will make at the review, such as closing the case, escalating to law enforcement, adding safety measures, or continuing monitoring.
The information that must exist before that decision can be made responsibly.

If the reviewer cannot say what new information would change the outcome, the review is a ritual. Rituals are fine for team morale. They are not a control.

Understand the two ways you can be wrong

Threat assessment carries two error types, and they pull in opposite directions. Your review cadence is the lever that trades one against the other.

Error type What it looks like in practice Who bears the cost Effect on review timing False positive A case is treated as serious when the risk is low. Interventions, leave, or restrictions are applied unnecessarily. The employee, through stigma, lost income, and damaged trust. The organization, through legal exposure and reduced credibility. Pushes toward shorter reviews that allow de-escalation sooner, and toward documented criteria for lifting measures. False negative A real risk is underestimated. Warning signs are closed too early or never revisited. Coworkers, the public, and potentially the employee. The organization, through harm and liability. Pushes toward shorter initial intervals and triggers that force review regardless of the calendar.

Most teams fear false negatives and quietly over-correct with long monitoring periods that generate paperwork but no new information. Other teams fear false positives so much that they close cases while signals are still developing. Neither instinct is a plan. Write down which error your current case is more exposed to, and why.

Match review timing to risk, not to habit

Risk-based review timing means the interval between reviews follows the assessed level of concern and the speed at which that concern can change. A case with a recent, specific, escalating threat and access to means needs a short interval. A case with an ambiguous comment from three months ago and no corroborating behavior does not.

Use a tiered approach, and make your tiers explicit in your organizational procedures so that two investigators facing similar facts reach similar timing decisions.

A working tier model

Elevated: specific threat language, identified target, access to weapons or sensitive systems, or recent escalation. Review in 7 days or sooner, with interim safety measures reviewed daily.
Moderate: concerning behavior without a specific target or plan, or a credible threat that has been partially mitigated. Review in 30 days.
Low: ambiguous statements, interpersonal conflict without threat content, or a concern that was resolved with clear evidence. Review in 60 to 90 days, or close with a documented re-open trigger.

These intervals are illustrations, not regulatory standards. Your legal and security teams should confirm them against your jurisdiction and your existing policies. The important part is that the tier, the interval, and the reason for both are written down before the review happens.

Event triggers override the calendar

A date on the calendar is a backstop. Certain events should force an earlier review no matter what the schedule says:

New threat language, in any channel, directed at a person or location
Reported changes in access, such as a termination notice, a disciplinary action, or a leave decision
A significant personal event known to the organization, such as a legal proceeding or a bereavement
Non-compliance with a safety plan or an agreed condition
A new witness account that contradicts the existing file

A worked example: the 30-day review

Consider a moderate-tier case. An employee in a customer operations role made a statement in a team meeting that a former manager "would regret how this ends." No specific plan was described. The employee has no history of violence in the file, but a formal performance dispute is ongoing and a final decision is scheduled for the following week.

The named decision-maker is Dana Whitfield, Director of People Operations. Her co-owner for security questions is Marcus Obi, Head of Corporate Security. Neither can delegate the final review decision.

The case record for this matter reads as follows:

Tier: Moderate. Concerning statement, no target identified in detail, no means identified.
Follow-up review date: 30 days from the date of the initial assessment. Review owner: Dana Whitfield. Security input owner: Marcus Obi.
Decision at review: Continue monitoring, step up to elevated tier, or close with documented findings.
Required before review: Outcome of the performance decision, documented interview with the employee, any new reports from the team, and confirmation of whether the former manager has been informed under our protective procedures.
Re-review trigger: Any new statement, any reported weapon access, or any failure to attend the scheduled interview, reviewed within 48 hours.

Notice what this record does. It names a person, not a department. It states what will be decided. It lists the information that must exist. It sets a fallback trigger that does not depend on the calendar. A later reviewer can read it and understand why the 30-day interval was chosen.

What we still do not know

Every case note in our own practice carries a running list titled "what we still do not know." It is the most useful section of the file because it prevents the review from pretending the investigation is complete. For the example above, the list might read:

Whether the statement was intended as a threat or as frustrated venting
Whether the employee has access to firearms outside the workplace, and whether that has been asked about lawfully
Whether anyone else heard the comment and interpreted it differently
How the employee will respond to the performance decision

Each item on the list should either have an owner and a due date, or be explicitly accepted as an unknown the team is choosing to live with for now. Unknowns that are accepted without a stated reason become the first thing a reviewer or an auditor asks about.

Using multiple AI models without outsourcing judgment

Many teams now use AI tools to summarize case files, flag inconsistencies, and draft review checklists. Some run the same input through several models and compare results. This can be useful, but only if the team understands what the comparison does and does not show.

Multi-LLM orchestration tools, such as the platform Suprmind.ai describes as a way to run prompts across models, make it easy to place side-by-side model outputs next to each other. That visibility is valuable. Treat it as a diagnostic, not a verdict.

Disagreement is a signal about missing information

When two models produce different risk tiers from the same file, the most common cause is not that one model is smarter. It is that the file is ambiguous or incomplete. One model may have inferred intent from a single phrase. Another may have weighted the absence of prior incidents more heavily. The disagreement points you to the question you have not answered.

When models disagree, record the disagreement itself in the case notes. Then ask what fact would resolve it. That fact goes on the "what we still do not know" list, and it becomes a precondition for the review.

Do not average, and do not count votes

Agreement between models is not proof. Three models that share training data, similar prompts, and similar blind spots can converge on the same wrong answer with great confidence. Averaging numerical scores from different models produces a number with no clear meaning, because the scales were never calibrated against each other and the errors are not independent. Treating a 2-to-1 split as a majority decision imports the logic of a poll into a question that needs evidence.

Be equally skeptical of any output that ends in "the AI said so." An explanation that cannot be traced to specific facts in the file is not an explanation. Require the reviewer to cite the evidence behind the tier, and require that the human decision-maker restate the reasoning in their own words.

Radomir Basta, CEO and founder of Four Dots, has written publicly about the value of comparing outputs across tools for search and content work. That logic transfers to regulated workflows only in part. In a threat case, the stakes of acting on a shared error are far higher than in marketing, and the accountability cannot be delegated to the tool.

Vendor pages can make trial access easy to start. The Start Free Trial option for Suprmind.ai is listed with no credit card needed, but the scraped content for this article does not include pricing, so verify current terms directly before procurement.

Defensible documentation checklist

When the case is later reviewed by legal counsel, an insurer, a regulator, or a court, the question will be whether the organization acted reasonably on what it knew. Your documentation should let a stranger answer that https://suprmind.ai/hub/insights/threat-assessment-meets-ai-governance/ question. Before closing any review entry, confirm:

The named decision-maker and their role are recorded.
The risk tier and the evidence supporting it are stated.
The review interval and the reason for it are stated.
Event triggers that would force an earlier review are listed.
The "what we still do not know" list is current, with owners and dates.
Any AI-assisted analysis is identified, with the disagreement noted and resolved by a human.
The language in the record is factual and neutral, avoiding speculation about the employee's character.

Write in plain sentences. Avoid informal punctuation in formal records, and keep each entry short enough that it can be read in under a minute. Length is not rigor.

Time-box the follow-up itself

A review date should come with its own limits. Set a time box for the review meeting, usually 30 to 45 minutes, and a time box for preparing the input, usually no more than two working days. If the review cannot produce a decision within its time box, the decision defaults to the next tier up until someone with authority decides otherwise. This prevents reviews from quietly sliding into indefinite monitoring.

Summary

Setting a follow-up review date is a risk decision with named ownership. Choose the interval based on the tier and the speed of change, backstop it with event triggers, and write down what must be known before the next decision. Use AI tools to surface gaps and disagreements, not to produce verdicts. Keep a running list of what you still do not know, and make sure a named person is accountable for every date on the calendar.