Violence and Aggression at Work
Work-related violence covers any incident where a person is abused, threatened or assaulted in circumstances relating to their work. That includes verbal abuse, threats of harm, online or telephone harassment, and physical assault - whether from customers, service users, patients, the public, or anyone else encountered in the course of work. It does not just mean physical attacks, and the harm caused is not always physical.
Some sectors carry much higher risk than others - healthcare, social care, retail, hospitality, transport, security, housing and public-facing public services all see higher rates of violence and aggression than office-based work. Any workplace that has contact with the public has some exposure, and the level of risk varies with who the public are, what they are dealing with, and how the interaction is managed.
The Impact of Workplace Violence and Aggression
Physical harm from an assault is the most obvious impact, but it is often not the most significant. Workers exposed to threats, verbal abuse or sustained aggression frequently report stress, anxiety, sleep problems and long-term mental health effects. Witnesses to an incident can be affected even if they were not the target. The effect builds cumulatively - a single incident may be manageable, but repeated low-level aggression over months or years causes real and lasting harm.
For the organisation, the consequences show up in sickness absence, staff turnover, recruitment difficulty, insurance premiums, and in some cases compensation claims and enforcement action. Organisations that manage the risk well tend to find it cheaper than organisations that ignore it.
Risk Assessment for Violence and Aggression
A specific risk assessment for violence and aggression is the starting point. In the UK, this sits under the general duty in the Health and Safety at Work etc. Act 1974 and the risk assessment duty in the Management of Health and Safety at Work Regulations 1999. There is no separate "violence at work" regulation, but the duty to protect workers from foreseeable harm applies just as much to aggression from members of the public as to any other workplace hazard.
A reasonable risk assessment asks:
- Who is potentially exposed - which roles, which locations, which activities
- What has happened in the past, in this organisation or in similar ones
- What triggers aggression in this setting - waiting times, bad news, intoxication, financial distress, service refusals
- Whether lone workers or home visitors face higher risk than those working in teams
- What physical controls are in place - layout, barriers, alarms, CCTV, escape routes
- What procedural controls are in place - booking systems, communication protocols, de-escalation training, incident reporting
- What support is provided after an incident - counselling, time away from the task, follow-up with the person affected
The assessment should be specific to the work, not a generic template. A housing officer visiting tenants, a receptionist in a busy GP surgery, and a warehouse worker loading pallets for the public face very different patterns of risk.
Controls for Violence and Aggression
Most practical controls fall into a small number of categories:
- Physical layout and security - controlled access, screens, secure exits, clear sightlines, CCTV, good lighting, panic alarms, a safe area to withdraw to
- Staffing and supervision - not leaving individuals exposed alone where risk is higher, supervisor awareness of where people are, buddy systems for lone visits
- Communication - check-in systems for lone workers, known processes for raising concerns, clear escalation for situations that are deteriorating
- Training - conflict avoidance, de-escalation techniques, how to recognise rising aggression, when to disengage and get help
- Procedures - refusing service safely, removing the trigger where possible, calling for support, evacuating if needed
- Response and support - incident reporting, management follow-up, counselling, occupational health, redeployment where appropriate
Which of these matter most depends on the work. A retail shop needs physical layout, CCTV and incident reporting. A community nurse needs lone-worker systems, check-in protocols and de-escalation training. A call centre dealing with distressed callers needs communication scripting, supervisor support and time away from the phones after a difficult call.
Lone Workers and Violence and Aggression
Lone workers carry higher risk because help is further away and an incident can escalate before anyone else is aware. The controls used for lone workers overlap heavily with violence and aggression controls - check-in systems, personal alarms, known whereabouts, buddy arrangements. A dedicated lone worker risk assessment usually captures more detail on these controls than a general V&A assessment would.
For home visits, the practical bar is higher. Visits to unknown addresses, to premises with known risks, or to individuals with a history of aggression all warrant specific procedures - pre-visit risk checks, escort arrangements, time-limited visits with check-ins, and clear rules on when a visit is called off or abandoned.
Reporting and Learning from Incidents
An incident reporting process that workers trust is essential. Many incidents of verbal abuse and low-level aggression go unreported because workers see them as "part of the job" or believe that nothing will be done. The effect is that the organisation loses the information it needs to see patterns and improve controls.
In the UK, physical injuries arising from acts of non-consensual violence at work are reportable under RIDDOR 2013 if they meet the criteria for specified injuries, over-seven-day incapacity or death. That makes internal reporting a regulatory requirement, not just a learning exercise. Near misses and verbal incidents that do not meet the RIDDOR threshold should still be reported internally so that controls can be updated before someone is physically harmed.
The thing organisations get wrong most often is treating verbal abuse as something workers should just put up with. They do not - the cumulative effect on staff retention and mental health is significant, and the employer still has a duty to manage it.
Training is also undercooked. A half-day on de-escalation at induction is not a system. Staff in high-risk roles need regular refreshers, debriefs after incidents, and a manager who actually listens when concerns are raised.
And lone worker systems need testing. An app that nobody opens, a check-in call that goes straight to voicemail, a panic alarm that hangs up after two rings - these exist in the wild and they give organisations false comfort.
We have members of the public on site for collections and deliveries. Most of it is fine. Occasionally someone kicks off - usually over a delayed order or a quality complaint.
What changed things for us was getting the reception team to record every incident, not just the ones that escalated. Once we could see the pattern we moved the queue layout, added better signage on waiting times, and retrained the team on handling complaints before they tipped over.
Violence and aggression comes up under ISO 45001 through the hazard identification and risk assessment requirements, and under worker consultation. The standard does not call it out by name but it does require the organisation to identify hazards from routine and non-routine activities, and to consider human factors.
A well-run system will have the V&A risk assessment, a record of incidents, evidence that workers have been consulted on controls, and documented training. An auditor will want to see that incidents are feeding back into the risk assessment rather than just being logged and filed.
Practical Compliance Guidance
Management of violence and aggression is covered within the operational controls and risk assessment arrangements set out in the IMS1 Manual. It sits alongside lone working, security and the general health and safety arrangements rather than as a separate section.
The alphaZ documents below cover the risk assessment, the policy options and the lone working controls that usually accompany a V&A management approach. Most organisations need a subset rather than all of them - choose according to the risk profile of the work.
| alphaZ document | How to use it |
|---|---|
| ISO 9001, 14001 and 45001 IMS Toolkit | Full integrated management system toolkit containing the violence and aggression documents listed below alongside the wider management system templates. |
| RA-HS115 Violence and Aggression at Work Risk Assessment | Example risk assessment covering verbal abuse, threats and physical violence from members of the public, with typical control measures. |
| RA-HS04 Lone Worker Risk Assessment | Example risk assessment for lone working situations, covering the controls that most directly address the violence and aggression risks lone workers face. |
| RA-HS09 Security and Safety Risk Assessment | Example risk assessment covering site security and personal safety, useful where physical layout and access control are key parts of managing aggression. |
| P-99 Violence and Aggression Policy | Standalone policy template setting out the organisation position on violence and aggression, worker responsibilities and the arrangements in place. |
| P-15 Lone Working and Violence Policy | Combined policy covering both lone working and violence, suitable where the two topics are best managed together rather than as separate documents. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation is directly relevant to violence and aggression at work. Organisations outside the UK should identify the equivalent legislation applicable in their jurisdiction.
- Health and Safety at Work etc. Act 1974
- Management of Health and Safety at Work Regulations 1999
- Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013
- Protection from Harassment Act 1997
- Equality Act 2010
