Bomb Threat and Suspicious Package Procedure

Why should a bomb threat procedure be in the emergency plan?

A threatening call to the switchboard, an unattended bag left in reception or a strange package arriving in the post room are events that catch most workplaces unprepared. Most of these turn out to be hoaxes; but that they are hoaxes only becomes clear afterwards. A sound bomb threat procedure both protects people when the danger is real and limits unnecessary panic and lost production when a threat is a hoax.

Art. 4 of the Regulation on Emergencies at Workplaces, in defining an emergency, lists sabotage alongside fire and explosion; Art. 8 requires the possibility of sabotage to be taken into account when identifying emergencies. Art. 10 of the same regulation requires response and evacuation methods to be put in writing and people other than workers, such as customers and visitors, as well as nearby workplaces, to be taken into account.

The threat call form: what does the worker who takes the call do?

A threatening call is often taken by the switchboard operator, receptionist or security guard. What this person notes down in those few minutes is the most important information for the police's decision. That is why a printed threat call form should be ready at the switchboard, reception and security gatehouse.

The rules for the worker who takes the call are:

1. Stay calm and try to keep the conversation going. Do not interrupt or argue with the caller.
2. Signal to the person next to you. Get them to call 112 on another line and alert the decision-maker.
3. Write down the number on the display and the time.
4. Note what is said word for word. Do not interpret or summarise.
5. Ask the questions below and complete the form immediately after the call ends.

For threats received by email, message or social media, do not delete the message or reply; take a screenshot, preserve the sender and time details, and share the message only with the decision-maker and the police.

What should be done with a suspicious package?

A suspicious package may turn up together with a threatening call or with no warning at all. The following features make a package suspicious: an item with no identifiable owner that should not be there; unexpected post or post from an unclear sender; excessive tape and string; protruding wires, liquid stains or an unusual smell; obvious errors in the address and name; and attention-grabbing markings such as "personal" or "do not open".

The rule for the worker who notices the package is short: don't touch, move away, report.

• Do not open the package, move it, cover it or put it in water.
• Keep in mind where the package is and what it looks like so you can describe it clearly; if possible, mark it on a sketch from a distance.
• Do not use radios or mobile phones close to the package; report it once you have moved away.
• Move people nearby away calmly, and do not let anyone approach "to have a look".
• Call the decision-maker and 112; let nobody into the area until the police arrive.

Post room and front office staff should receive specific training on this; confirming the sender of an unexpected delivery before accepting it stops a significant share of suspicious packages at the door.

The decision to clear the area: who decides, and how is it carried out?

The most critical point in a bomb threat is who has the authority to order evacuation. This person must be named in the emergency plan, with a deputy for each shift; it is usually the employer's representative, the site manager or the emergency coordinator. When the police arrive on site, control passes to them; until then, the decision rests with the workplace. The table below is a starting point for typical situations:

An evacuation carried out while a suspicious object is present is not the same as a fire evacuation. When designing a security evacuation, the following differences are taken into account:

• Route: the evacuation route must not pass by the suspicious package. Because the general fire alarm will direct everyone to their usual routes, an announcement stating the route may be preferable. For announcement design, see our article on emergency alarm and announcement systems.
• Assembly point: the fire assembly point is often the car park; in a suspicious vehicle or package scenario, an alternative assembly point further from the building and away from glazed facades is needed.
• Personal belongings: workers take only their own bags with them; this reduces the number of unattended items left behind and makes the police search easier.
• Windows and glass: people who cannot be evacuated or are waiting to be evacuated are kept in inner areas away from external glazing.
• Head count: at the assembly point, a head count is carried out including visitors and subcontractor workers; Art. 10/2 of the Emergencies Regulation requires a head count after evacuation.

If there are several workplaces in the same building, the decision and announcement need to be made together with the building management; see joint emergency plans for workplaces in the same building.

Coordination with the police

When you call the police or when they arrive on site, have the following ready:

1. The completed threat call form or a screenshot of the threatening message.
2. The location and appearance of the suspicious package, and who noticed it and when.
3. Building sketches, floor plans and keys.
4. The status of the evacuation: who has left, is anyone still inside, where is the assembly point?
5. A technical manager who knows the site well: someone who can show where to shut off electricity, natural gas and ventilation.

A single person handles contact with the police; passing information from different people in different ways causes confusion. The same principle applies to announcements to workers: briefing at the assembly point is given by the decision-maker, and workers are asked not to share photos, videos or rumours about the incident on social media. The spread of unverified information both makes the police's work harder and reduces workers' trust in instructions the next time there is a threat. The decision to return to the building is only made after the police have declared the area safe. For plants within an OIZ (organised industrial zone), establishing contact with the OIZ security unit and fire brigade in advance makes things easier; see emergency coordination with the OIZ fire brigade.

Training, drills and records

A sabotage emergency scenario only works if the people involved know it. Train these groups in particular: switchboard and reception staff, security guards, post and goods-in staff, shift supervisors and the protection team among the emergency teams. Not every annual drill has to be a fire scenario; holding a tabletop bomb threat exercise one year reveals gaps in the decision chain. For drill planning, see our article on how to carry out an emergency drill.

The most common mistakes in real incidents and drills are:

• The person taking the threatening call panicking, hanging up and noting nothing down.
• No clear decision-maker; everyone asking each other "what shall we do?".
• The suspicious package being opened "to find out whose it is" or moved somewhere else.
• People going to the fire assembly point out of habit; the assembly point being close to a suspicious vehicle.
• Workers returning to the building to collect their belongings before the police have declared the area safe.

After every incident, carry out a short review: how did the threat arrive, was the form completed, how many minutes did the decision take, how did the evacuation go? Enter the findings into the emergency plan. Preventive arrangements such as visitor registration, an unattended items rule and goods-in procedures are also part of the plan. We adapt the scenario to your workplace through our emergency plan service and brief the relevant workers as part of our OHS training.

Frequently Asked Questions

Should the building be evacuated immediately when a bomb threat is received?

Not in every case. With a threat giving a specific location and time, or when a suspicious package is found, the relevant area is cleared immediately. With vague threats, 112 is informed and a decision is made according to police guidance. The decision is made by the person named in the emergency plan.

Can we carry a suspicious package outside?

No. The package is not opened, moved, covered or put in water. What needs to be done is to clear the surrounding area, prevent access and wait for the police.

Where should the threat call form be kept?

Next to every telephone likely to receive a threat: the switchboard, reception, the security gatehouse and call centre desks. The form should be short enough to be filled in during the call.

Should the fire alarm be sounded for a bomb threat?

The general fire alarm sends everyone along their usual routes to the assembly point; this is risky if those routes pass near the suspicious package. For this reason, an announcement stating the route and assembly point may be preferred for a security evacuation. Which method will be used is decided in advance in the emergency plan.