Cornell University Risk Manager on Active Shooter Preparedness on Campus

How to manage active shooter risks on campuses is a top concern for risk managers.

Craig McAllister, director of risk management, Cornell University, told attendees at the recent RIMS Annual Conference in San Antonio, Texas, there are ways that facilities can plan the design and construction of buildings to mitigate risk but often those techniques might be less effective in a higher education setting where open space is plentiful.

“However, if you look at how our courthouses, federal buildings, how things have changed since the bombing in Oklahoma City, since 9/11, they are different facilities today,” he said. “There are often barriers around the outside of buildings now.”

The same design and construction techniques are happening in newly constructed K-12 schools, he added. But for older campuses, retrofitting with tools like bullet-proof glass or secured doors is expensive and not always possible. “And again, with higher education, we have open campuses with many buildings and people passing between buildings on a regular basis. To really lock that down doesn’t work well.”

Another step in a campus active shooter risk management plan is crisis communication. McAllister emphasized ensuring proper connections and contracts are in place ahead of any incident. Institutions should have partnerships with crisis communication teams, counseling services for students and employees and even the general community in place. “One of the things that we’ve done at Cornell is we’ve worked with other educational institutions locally and have a mutual aid agreement in place. So, other institutions that are similar in our size, maybe an hour-and-a-half away, can help provide additional support to us if necessary.”

Another part of active shooter preparation is proper training. “People need to understand what their roles are, what their duties are and what they will have to do during an incident,” McAllister said. “At Cornell, we use the National Incident Management System and Incident Command Control System. Just really having these in place so people understand their duties and their roles has been helpful.”

Training isn’t only for top executives and leaders. “It’s training for all individuals, so they understand how they should respond during an incident,” he said.

There is also a growing responsibility for duty of care when it comes to education institutions and active shooter risk, especially in higher-ed settings.

“This is something that continues to evolve with the expectations of our students and their parents, but also society at large,” he said. What obligation do administrators have to the people on campus? “Understand your moral obligation,” he said. “Ultimately, we want to do the right thing and how that can be defined by others, so we need to be prepared.”

The definition of what campuses owe students is evolving, too, he said. “In most situations, we consider our students as invitees to our campus, meaning that we have a higher standard for community of care. Certainly, we couldn’t entrap them, we couldn’t injure them, but we have to make sure that they were appropriately protected.”

Then there’s the recovery portion of a risk management plan. “This ultimately includes providing the appropriate level of services and support to the campus community after the incident,” McAllister said.

This is done through communications during the incident and after, as well as during any litigation process, he said. “When you look at litigation, we have a duty and as the duty is evolving, what duty do we owe to our students, our employees, but also how did we reach that duty? Did we fail to fulfill or warn our community?”

As those duties continue to evolve, risk managers must watch and change to meet that duty of care.