Planning a High-Risk Termination: What Employers Get Wrong

Most terminations need a room, a letter, and twenty minutes. A small number need a plan built weeks earlier by someone who will not be in the room, and employers usually cannot tell which kind they have until the morning of. The call we get most often comes at 7:40 a.m. for a 9:00 a.m. meeting. That is not a plan. That is a request to stand in a hallway and hope.

Short answer: a termination is high risk when there is a credible possibility of violence, sabotage, data theft, or serious disruption, and almost everything that makes it safe happens before the meeting rather than during it. The order is fixed: assess the risk, using someone who is not delivering the news; build one written plan from that assessment; only then set the room, the time, and who is present; then run a defined monitoring window afterward. Ontario employers also carry statutory duties: the Occupational Health and Safety Act requires you to assess the risks of workplace violence (s. 32.0.3(1)) and, in defined circumstances, to warn a worker about a person with a history of violent behaviour (s. 32.0.5(3)). One division of labour matters more than anything else here. The employer and their counsel decide whether and how to terminate. The investigator assesses and mitigates the risk around it.

Several parts of this turn on statutory interpretation. Treat it as orientation, and have employment counsel review a live file before you act.

What actually makes a termination high risk

The phrase gets used loosely, usually to mean “this one will be unpleasant.” Unpleasant is not dangerous, and staffing a protective detail for an ordinary termination costs money and signals a threat that is not there. The indicators that genuinely move a file are narrow, and most are documented somewhere already:

• Documented threats or a history of violence. Direct or veiled, in person or online, here or at a previous employer. The OHSA definition includes a statement a worker could reasonably read as a threat of physical force, so it need not be explicit to count.
• Escalating grievance behaviour. A fixation narrowing onto one manager, one coworker, one decision, with complaints growing in intensity while shrinking in scope.
• Known weapons access, combined with any of the above. Lawful firearms ownership on its own is not a risk indicator, and treating it as one is wrong and unfair.
• Domestic violence that has already touched the workplace. A partner appearing on site, calls to reception, an employee who has disclosed a situation at home.
• Severe personal stressors. Separation, custody proceedings, eviction, a health crisis, escalating substance use. None is predictive alone. Several stacking in the quarter of a termination is another matter.
• Privileged access or custody of assets. Administrators, finance staff, anyone holding client data, master keys, cash, or the only copy of something. The realistic risk is often not violence but exfiltration, deletion, or a quiet transfer to a competitor.

An employee who cries is not a high-risk termination, and neither is one who has retained a lawyer. The second is a legal problem, not a safety one, and confusing them produces a security posture a court later reads as intimidation.

The assessment cannot be done by the person delivering the news

A manager who has been in conflict with the employee for six months tends to overstate the danger; in hindsight everything the employee said reads as a threat. A manager who likes the employee tends to explain the same signs away. Both distortions are ordinary, neither is deliberate, and the person who will sit across the table at 10:00 a.m. is by definition invested in the answer.

An assessment worth having is done by someone with no relationship to the outcome and no role in the meeting. In our practice that work is planned and led by certified workplace violence and threats specialists, because reading a volatile situation correctly before it happens is a specific skill rather than a general one.

What it is built from is unglamorous: the personnel file, incident reports and prior complaints, any harassment investigation file, communications the employer already lawfully holds, firsthand interviews, and lawful open-source research. Not the manager’s impression, and not a covert recording of the employee: there are lawful ways to document a conversation in Ontario and fast ways to commit a Criminal Code offence, so read our note on recording conversations in Ontario first. Keep the scope proportionate: Ontario has no general private-sector privacy statute covering employee records and PIPEDA reaches employee information only in federally regulated workplaces, so collect what the concern requires and do not build a dossier because you can.

What Ontario law actually asks of you

The framework comes from Bill 168, formally the Occupational Health and Safety Amendment Act (Violence and Harassment in the Workplace), 2009, S.O. 2009, c. 23, whose violence provisions came into force on 15 June 2010 and now sit in Part III.0.1 of the Occupational Health and Safety Act.

The duty to warn is narrow, and it is regularly either ignored or overshot. It permits disclosing personal information, which is unusual in Canadian law, and s. 32.0.5(4) is the reason: no more than is reasonably necessary to protect the worker from physical injury. In practice that means telling reception, the security desk, and the people nearest the exit what to watch for, not circulating a photograph and a narrative company-wide.

The assessment duty does not name terminations. But a termination a reasonable employer would recognize as volatile changes the conditions of work for everyone in that building that day, and s. 25(2)(h) requires every precaution reasonable in the circumstances. Write the assessment down: an inspector can order it produced in written form under s. 55.2, and reconstructing your reasoning two years later is far worse than recording it at the time. Under s. 66, contravention exposure runs to $500,000 for an individual and $2,000,000 for a corporation.

The sequence, and why order matters

Employers almost always start at step three.

1. Assessment. Independent, documented, finished before a date is chosen. It produces a finding rather than a feeling: what the risk is, who it is directed at, and what would reduce it.
2. The plan. One document built from that assessment by HR, legal, security and IT together.
3. Meeting logistics. Room, time, day, seating, duration, script. Making these first is how employers end up managing the wrong risk.
4. The monitoring window. A defined period afterward, with named responsibilities and an end date.

On timing: two to three weeks lets the assessment be done properly and the technical track be built without anyone noticing. Five business days is workable. Same-day is triage. High-risk termination planning is worth having before the date is set, not after.

Meeting logistics that actually matter

• Room and exit paths. Ground floor, two ways out, near an exterior door, away from the employee’s own team. The person delivering the news sits closest to the door, and nobody should have to walk past the employee to leave.
• Time and day. Early in the day, early in the week. Terminating at 4:45 p.m. on a Friday spares the employer discomfort and is close to the worst option available: it hands the person a weekend with no access to their lawyer or benefits administrator, and any escalation happens when your building is empty.
• Who is present. Three people maximum: the decision-maker, one HR witness taking notes, and the employee. Every additional body increases humiliation. Protective coverage, if any, stays outside.
• Duration. Ten to fifteen minutes, with the decision delivered in the first ninety seconds, plainly and once. Long meetings are where employers negotiate against themselves and turn a decision into a debate.
• What is said, and what is not. The decision, the effective date, what the package contains, who to contact, and how belongings and documents will be handled. Not a rehearsal of the employee’s failings, a comparison to colleagues, or a comment on their character. In Honda Canada Inc. v. Keays, 2008 SCC 39, [2008] 2 SCR 362, the Supreme Court gave attacking an employee’s reputation through declarations made at the time of dismissal as an example of conduct that can ground compensable damages (para. 59).
• Have the package ready. Letter, entitlements, benefits continuation, reference position, return-of-property list, printed and in the room. “We will get you the numbers next week” creates a reason to come back and a grievance to carry while waiting.

The parallel technical track

Access revocation is timed to the meeting. Not the night before, not at the end of the day. Cutting access early is one of the most common ways an employee learns what is coming, and someone who knows has time to copy files, forward mail, and prepare. Leaving it live afterward gives a newly terminated employee a working session on their phone in the parking lot. The pattern that works is IT revoking on cue: single sign-on, email, VPN, remote access, cloud storage, code repositories, CRM, payment authorities, and the third-party accounts nobody remembers until an invoice arrives. Shared credentials the person knew are rotated, not merely disabled for them.

Preserve before you wipe. This is the step most employers skip and most regret. Laptop, phone, mailbox and cloud storage should be forensically imaged before anything is wiped or reissued, because if a dispute develops the evidence you need is on a machine since handed to a new hire. Re-imaging destroys deleted-file recoverability and much of the trail showing what was copied and when. Our piece on what is recoverable and what is admissible covers the difference between holding data and being able to use it. Use of credentials after termination can also engage Criminal Code s. 342.1, unauthorized use of a computer.

Physical control and property. Badges, fobs, keys, alarm codes, fleet access, safe combinations. Codes get changed, not just deactivated for one holder, and a master key means rekeying the affected cores.

Where the concern is asset diversion rather than violence, some of this belongs to a broader inquiry. Workplace investigations run before the termination decision often establish whether there is anything to preserve, and our guide to spotting employee fraud covers the indicators that surface first.

The protective presence question

Employers ask for a guard in the room. It is almost always the wrong call. A uniformed officer across the table tells the employee, before a word is spoken, that they are considered dangerous, and people who are told they are dangerous frequently oblige. It also turns a private decision into a spectacle for anyone who sees the person walk in or out, which is exactly the kind of fact that resurfaces in a claim about the manner of dismissal.

What normally works is discreet coverage: one or two protective specialists outside the room in plain business dress, close enough to intervene within seconds and invisible to anyone who does not know they are there, briefed on the assessment, the layout, the exit route, and the behaviours that would prompt them to move. If the employee stays calm, they never become part of the story. Close protection built this way is an intervention capability, not a display. Visible uniformed security has a place, for an articulable known threat or a person who has already attended the premises after being told not to, but that is a posture chosen for a documented reason, not a default.

The 30 to 90 days after

The meeting is not the end of the risk period. In most files it is the start of the part people stop paying attention to. Define a monitoring window in the plan, with a start, an end, and named responsibilities. Thirty days is a reasonable floor; ninety is common where the assessment identified fixation on a specific person.

• Brief the right people at the right scope. Reception and the security desk get a description and a clear instruction. Where s. 32.0.5(3) is engaged, the worker at risk is told, limited by s. 32.0.5(4). Everyone else gets to know the person no longer works there.
• Remaining staff have rights too. A worker with reason to believe workplace violence is likely to endanger them may refuse work under s. 43(3)(b.1), and an incident that disables a worker triggers s. 52(1) notice within four days.
• Watch the digital perimeter, not just the doors. Failed logins on disabled accounts, mail-forwarding rules created before the exit, unusual downloads in the final weeks, and contact with clients or suppliers.
• Take the domestic violence duty seriously. If a terminated employee’s partner is the risk, or a remaining employee’s partner has just been terminated, s. 32.0.4 is live. Job loss is a recognized destabilizer in coercive and controlling relationships, and the workplace is often the one address an abusive partner reliably knows. Our overview of coercive control and Canadian law sets out where the law stands.
• Know which remedies belong to police. Repeatedly following someone, besetting their workplace, or threatening conduct causing reasonable fear for safety can constitute criminal harassment under Criminal Code s. 264, and threatening death, bodily harm or property damage is an offence under s. 264.1. A s. 810 peace bond is available where a person fears on reasonable grounds that another will cause personal injury or damage property, and where weapons are a concern police can seek a warrant under s. 117.04. An investigator documents behaviour to the standard a court expects, but nobody in the private sector substitutes for calling police when a crime is in progress.

Coordinating with counsel so the plan does not become the evidence

A well-run security plan and a well-run termination pull in the same direction. A badly-run security plan is itself a legal exposure.

Start with entitlements, the least discretionary part. Under the Employment Standards Act, 2000, statutory notice runs from one to eight weeks by length of employment (s. 57), an employer may pay termination pay in lieu (s. 61), and wages and benefits continue through a working notice period (s. 60). Statutory severance is separate: owed where the employee has five or more years of service and the employer has a payroll of $2.5 million or more, or where 50 or more employees are severed within six months due to a permanent discontinuance (s. 64), at one week per year of service, capped at 26 weeks (s. 65). These are floors, and common-law reasonable notice is usually a great deal more. O. Reg. 288/01 removes both for wilful misconduct, disobedience or wilful neglect of duty that is not trivial and has not been condoned (ss. 2(1)3 and 9(1)6), but that exemption is narrow, routinely overestimated, and counsel’s call rather than security’s.

Then the part where the security plan can hurt you. In Honda Canada Inc. v. Keays, the Supreme Court held that damages for the manner of dismissal are available where the employer’s conduct during the dismissal was unfair or in bad faith, and that such damages are compensatory and assessed on ordinary principles rather than by inflating the notice period (paras. 57 and 59). Punitive damages remain available but are confined to advertent wrongful acts so malicious and outrageous as to deserve punishment on their own (para. 62). A protective posture proportionate to a documented assessment is defensible. A theatrical one is a set of facts a plaintiff can use: the uniformed guards, the walk across the floor, the belongings at reception, the announcement to the team.

Three rules keep the tracks aligned. Counsel drafts the letter and the entitlements while security drafts the movement plan, and neither improvises in the other’s lane. Write the risk assessment as an assessment, with dated findings and the material relied on rather than speculation about character. And do not let the security plan announce the reason for the termination, because how a person is walked out tells the floor more than any memo.

What to do next

If a specific person is on your mind: write down what you know, separating documented fact from hearsay; call employment counsel about the decision, the grounds, and the package, because that is their file; get an independent risk assessment before you pick a date; build one plan from it with named owners; and set an end date for the monitoring window rather than letting it lapse.

If you are unsure whether your situation is high risk, that uncertainty is worth a conversation on its own. A good share of the assessments we do end with a recommendation that no protective presence is needed and the termination proceeds normally. That is a good result, and a cheap one.

To talk through a file confidentially, contact us or use Assign a Case. The answer is more useful three weeks out than three hours out.

Frequently asked questions

What makes a termination high risk?

A termination is high risk when there is a credible possibility of violence, sabotage, data theft, or serious disruption. The usual indicators are documented threats or a history of violence, escalating grievance behaviour, known access to weapons combined with any of the above, domestic violence that has already reached the workplace, severe personal stressors, and privileged system access or custody of cash, keys or client data. An employee who is simply going to be upset is not a high-risk termination.

Why can’t the manager who is delivering the termination also assess the risk?

Because they are the wrong person to read it. A manager who has been in conflict with the employee tends to overstate the danger, and a manager who likes the employee tends to explain the warning signs away. Both distortions are ordinary and neither is deliberate. The assessment should be done by someone with no relationship to the outcome and no role in the meeting, working from documents, incident reports, and interviews rather than impressions.

Does Ontario law require an employer to assess workplace violence risk before a termination?

Ontario’s Occupational Health and Safety Act requires employers to assess the risks of workplace violence arising from the nature of the workplace, the type of work, or the conditions of work, under section 32.0.3(1), and to reassess as often as necessary. It does not name terminations specifically. But a termination that a reasonable employer would recognize as volatile changes the conditions of work for everyone in that building, and section 25(2)(h) requires every precaution reasonable in the circumstances.

Should uniformed security be in the termination meeting?

Usually not in the room. A uniformed guard sitting across the table tells the employee they are considered dangerous before anything has been said, and people who are told they are dangerous frequently oblige. Protective coverage in a high-risk termination is normally discreet and positioned outside the room, close enough to intervene in seconds. Visible uniformed presence has a place, but it is a deterrent posture for a known, specific threat, not a default setting.

When should system access be revoked in a high-risk termination?

At the moment the meeting begins, not before and not hours after. Cutting access the night before is one of the most common ways an employee learns what is coming, which destroys the plan and gives them a head start on copying data. Leaving access live until the end of the day gives a terminated employee an open window from their phone in the parking lot. IT should revoke on cue, with a preservation image of the device taken before anything is wiped or reissued.

How much notice does an investigator need before a high-risk termination?

Two to three weeks lets the assessment be done properly and lets the technical and protective planning happen without anyone noticing. Five business days is workable. A same-day call is triage: what can be delivered on eighty minutes’ notice is a protective presence in a corridor and an honest warning that the useful work was skipped. Call before the date is set, not after it is scheduled.

Ontario legal context

High-risk termination planning in Ontario sits inside a defined framework. The Occupational Health and Safety Act, as amended by Bill 168 (the Occupational Health and Safety Amendment Act (Violence and Harassment in the Workplace), 2009, S.O. 2009, c. 23, violence provisions in force 15 June 2010), sets the policy, program, assessment and disclosure duties in Part III.0.1, alongside the employer’s general duty under s. 25(2)(h) to take every precaution reasonable in the circumstances. Termination entitlements come from the Employment Standards Act, 2000 and O. Reg. 288/01. The manner of a dismissal is governed at common law, where Honda Canada Inc. v. Keays, 2008 SCC 39, [2008] 2 SCR 362 remains the leading authority on damages for bad-faith conduct in the course of dismissal. Criminal remedies for threatening or harassing conduct sit in the Criminal Code, principally ss. 264, 264.1, 810 and 117.04. Investigation and protective work for hire in Ontario is licensed activity under the Private Security and Investigative Services Act, 2005 and O. Reg. 363/07.

This article is general information about investigative practice in Ontario, not legal advice. Laws change and every situation is different. For advice about your specific circumstances, consult a licensed Ontario lawyer or contact a licensed investigator directly.