"Michael Julian has written an excellent book. Practical, detailed, and a potential life saver if you find yourself in the midst of a targeted attack."
Drills Are Not Training: How to Build an Active Shooter Preparedness Program That Holds Up
An active shooter preparedness program is a documented, repeatable system of instruction, policy, drills, and after-action review that an organization maintains year over year. It is not a single class, and it is not an annual lockdown drill. The drill is one component inside the program, and it is the component most organizations mistake for the whole thing.
That confusion is expensive. In our 30 years of training organizations across the country, the most common finding when we walk into a company that believes it is prepared is a binder nobody has opened, a drill nobody debriefed, and a workforce that has never practiced a decision under stress.
What is the difference between a drill and training?
A drill tests whether people can execute a procedure they already know. Training builds the capability the procedure assumes. Running a lockdown drill with employees who have never been taught how to evaluate an exit, barricade a door, or move under stress does not produce readiness. It produces a timed walk-through.
The distinction matters because the two answer different questions. A drill answers "did the alert reach everyone and did doors lock?" Training answers "can this person make a survivable decision in the first eight seconds without waiting to be told?" Both belong in a program, but only one of them changes behavior. We have written before about rehearsing a procedure versus building a skill, and it remains the single most useful frame for organizations deciding where to spend a limited safety budget.
What does a complete program contain?
A program that survives scrutiny has six parts, each with an owner and a date.
A written policy. Who declares an emergency, how notification happens, what employees are authorized to do, and what happens afterward. If it is not written, it does not exist during litigation.
A threat assessment process. A named team, a reporting path employees actually know about, and documented criteria for escalation.
Initial training for every employee. Delivered live where possible, covering decision-making under stress rather than a video and a signature.
Refresher training on a fixed cycle. Skills decay. Annual is the working minimum for most organizations.
Drills and exercises. Including tabletop exercises for leadership, which are cheaper and often more revealing than full-scale drills.
After-action review. Written, dated, with corrective actions assigned to people, not to departments.
Miss the sixth item and the program stops improving. Most do miss it.
What does the law actually require of employers?
There is no single federal standard for active shooter training. What exists is the General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health Act, which obligates employers to furnish a workplace "free from recognized hazards" that are likely to cause death or serious physical harm (OSHA, Section 5, Duties). OSHA has used that clause as the basis for workplace violence enforcement, and its position is that violence is a recognized hazard in identifiable industries (OSHA, Workplace Violence).
The exposure is not theoretical. The Bureau of Labor Statistics recorded 470 workplace homicides in 2024, up from 458 in 2023, out of 733 fatalities caused by violence and other injuries by persons or animals (BLS Census of Fatal Occupational Injuries, 2024).
Several states now go further. California requires most employers to maintain a written workplace violence prevention plan with annual training and a violent incident log under Labor Code 6401.9. K-12 drill requirements vary state by state. Check your jurisdiction rather than assuming a national floor.
How often should each piece run?
All-employee training: at onboarding, then annually.
Tabletop exercise for leadership and the threat assessment team: annually.
Full drill: once or twice a year, coordinated with local law enforcement where possible.
Policy review: annually, and after any incident or near miss.
After-action review: within two weeks of every drill or incident, while memory is intact.
Frequency is what separates a program from an event. An organization that trains once and never again has bought a moment of comfort, not a capability.
Should you build an internal instructor cadre?
For organizations above roughly 200 employees, or with multiple sites, high turnover, or shift work, the answer is usually yes. External training establishes the standard. Internal instructors keep it alive between visits, deliver onboarding without waiting for a scheduled date, and give you someone accountable for the program on site.
The economics tend to favor it quickly once you count new hires. Organizations that reach this point often look at certifying your own people to deliver it as the next step after their first round of outside training.
What will an auditor, insurer, or plaintiff's attorney ask to see?
The same four things, in the same order: the written policy, the training roster with dates and signatures, the drill records with after-action findings, and evidence that the findings were acted on. Programs fail that review not because training never happened but because nobody kept the paper. Assign records custody to a named person on day one.
Frequently asked questions
Is a lockdown drill enough to satisfy an employer's obligations? Generally no. A drill demonstrates that a procedure can be executed but does not establish that employees were trained in the underlying decisions and skills. Regulators, insurers, and courts look for documented instruction, not only rehearsal.
How long does it take to stand up a real program? Most organizations can have policy, a threat assessment path, and first-round training in place within 60 to 90 days. Reaching a steady state with refreshers, drills, and after-action review on a calendar usually takes a full year.
Who should own the program internally? A single named individual, typically in safety, security, HR, or operations, with executive sponsorship and budget authority. Programs split across departments without one owner tend to stall after the first year.
Do we need to involve local law enforcement? Involving them is strongly recommended for drills and site familiarization. Officers who have walked your building before an incident respond differently than officers seeing it for the first time.
What records should we keep, and for how long? Training rosters, curriculum outlines, drill scenarios, after-action reports, and corrective action logs. Retain them at least as long as your general liability and employment records retention schedule requires, and never discard the version that documents a correction.
How do we train remote and hybrid employees? Deliver core decision-making content in a live virtual session, then cover site-specific procedures separately for the days those employees are on site. Do not let a hybrid schedule become a reason nobody is trained.
Build a program, not an event
If your organization has a drill on the calendar and nothing else, you have a rehearsal without a skill behind it. Contact A.L.I.V.E. Active Shooter Survival Training to talk through what a full program would look like for your sites, your headcount, and your regulatory environment.
About the author
Michael D. Julian brings more than 30 years of security and investigations experience to organizational preparedness. He is the creator of the A.L.I.V.E. Active Shooter Survival Training program and served as President of the California Association of Licensed Investigators from 2005 to 2015. Connect with him on LinkedIn.
LEARN HOW TO SURVIVE AN ACTIVE SHOOTER!
ALSO AVAILABLE FOR AUDIO DOWNLOAD, E-BOOK, AND PAPERBACK / HARDCOVER ON AMAZON
Hear From An A.L.I.V.E. Student Survivor Of The Las Vegas Massacre
"As a retired 32 year law enforcement veteran, with several years of SWAT and tactical experience, I learned some different unique perspectives as it pertains to civilians dealing with active threat situations. Very good class for civilians who may have never experienced reacting to a life and death stressful situation."
- Christopher C.
A.L.I.V.E. STANDS FOR:
Assess
Assess the situation quickly
Leave
Leave the area if you can
Impede
Impede the shooter
Violence
Violence may be necessary
Expose
Expose your position carefully for safety
INDUSTRIES WE SERVE
Corporations
Government
Healthcare
Places of worship
Schools & Universities
Venues
MICHAEL JULIAN
Creator of A.L.I.V.E.
A.L.I.V.E., which stands for Assess, Leave, Impede, Violence, and Expose, was created in 2014 when Michael began teaching his Active Shooter Survival philosophy throughout the United States. His book on the subject, 10 Minutes to Live: Surviving an Active Shooter Using A.L.I.V.E. was published in 2017 and the online version of the A.L.I.V.E. Training Program was launched in 2019 and is now part of the corporate security training program for companies throughout the world.
Why A.L.I.V.E. Active Shooter
Survival Training Program?
The A.L.I.V.E. Active Shooter Survival Training Program is a comprehensive training program designed to provide individuals with the necessary skills and knowledge to survive an active shooter incident. Its emphasis on situational awareness and decision-making makes it a practical and effective approach to active shooter situations. By empowering individuals to take proactive measures to protect themselves and others, the program can help prevent tragedies and save lives.