Most Australians will never see a bomb threat. But the workplaces that do almost always handle them poorly, because the procedure is counterintuitive: it is quieter than a fire response, slower in some respects, and the natural instinct (sound the alarm, head for the nearest exit) can make the situation worse. Bomb threats sit in a category of emergency where doing the right thing requires training, not common sense.

This guide walks through the full Australian procedure under AS 3745:2010 Appendix B, the practical handling of each threat delivery channel (phone, written, email, in-person, and physical suspect item), and the immediate steps after a threat is received. It pairs with our companion guide on handling a bomb threat phone call, which goes deeper on call-taker technique, and with our bomb threat checklist for the form your reception or front-desk team should have within reach.

The Australian context

Australia’s National Terrorism Threat Advisory System is currently set at PROBABLE, the third-highest of five levels (Not Expected, Possible, Probable, Expected, Certain). ASIO raised the level from “Possible” to “Probable” in August 2024, and it has been maintained at that level since. “Probable” means there is credible intelligence that individuals or groups have both the intent and the capability to conduct a terrorist attack in Australia, and that an attack is assessed as more likely than not within the next twelve months.

For Australian workplaces, that elevated baseline matters in two ways. First, bomb threat procedures are no longer a paper-exercise compliance item. Second, the most likely scenario in practice remains hoax calls (which still need a procedural response), but workplaces also need to be ready for genuine suspect items and the consequences of getting the response wrong.

For broader context on the Australian threat environment and what it means for workplace planning, see our risk and threat preparedness guide.

Why the bomb threat procedure differs from a fire response

The first thing to understand about bomb threat procedures is that they invert several reflexes that the standard fire procedure has trained into building occupants. Five differences matter most:

• Do not sound the standard fire alarm immediately. A general fire alarm may move occupants directly past a suspect item. AS 3745:2010 Appendix B contemplates a quieter, controlled response using the PA system or runners.
• Do not use radios or mobile phones near a suspect item. Radio frequencies can potentially trigger certain electronic devices. Two-way radios used by wardens should be operated at a safe distance.
• The nearest exit is not necessarily the right exit. Evacuation routes are chosen to avoid the threatened area, even if that means using a more distant exit or stairwell.
• The standard assembly area may not be safe. Predictable, named assembly points are themselves vulnerable. The Chief Warden, often in consultation with police, may direct occupants to a secondary location.
• The Chief Warden does not make the call alone. The decision to evacuate, search, partially evacuate, or stay in place is made in consultation with police, who take operational control once on scene.

For the wider picture of how procedures shift across emergency types, see our guide to emergency evacuation procedures by emergency type.

How bomb threats are delivered

Bomb threats reach a workplace through five common channels. The handling differs by channel because the evidence value and the immediate priorities differ.

1. Phoned threats

Phoned threats are the most common form and the one most workplaces are least prepared for. The person who answers the call (often a receptionist or front-desk team member) is suddenly the most important person in the response. The objectives during the call are simple but disciplined:

• Stay calm. Do not interrupt the caller.
• Do not hang up. Let the caller end the call. Every additional second of conversation yields information.
• Take notes during the call. Use the bomb threat checklist if it is to hand. If not, write down everything you can.
• Listen for background sounds. Traffic, machinery, music, voices, an accent on a PA system in the background. All of these help police trace the call.
• Note caller characteristics. Gender, approximate age, accent, speech impediments, intoxication, emotional state.
• Ask the questions on the checklist. Where is the bomb? When will it explode? What does it look like? What kind of bomb is it? What will set it off? Did you place the bomb? Why? What is your name? What is your address?
• Do not transfer or put the caller on hold unless absolutely necessary.

The exact wording of the caller’s threat matters too. Write it down verbatim if you can. Australian police will ask for it.

For a deeper walk-through of phone call handling, including how to keep a caller talking and what to do if more than one person can listen in on an extension, see our companion guide on handling a bomb threat phone call.

2. Written threats (letter, note, package)

Written threats arrive in physical form: a letter, a note, a marker scrawl in a bathroom, an attached note on a package. The handling priorities shift to evidence preservation:

• Handle as little as possible. Fingerprints, DNA, and trace evidence on a written threat may identify the sender. Place the document in a clear plastic sleeve or folder if possible.
• Note who handled it, in what order, and when.
• Preserve the envelope or packaging including any stamps, postmarks, addressing and return address details.
• Photograph the document before it is handed to police.
• Do not show the threat to other staff beyond those who need to see it. Treat it as confidential.

3. Email and electronic threats

Email and electronic threats (including via social media, contact forms, SMS, or messaging apps) are increasingly common. They are also forensically rich.

• Do not delete the message. Email headers contain routing information that can identify the sender.
• Do not reply.
• Preserve the original. Take a screenshot. Forward the original (with full headers) to your IT or security team and to police as directed. Do not edit or amend the message.
• Note exact time of receipt.
• Identify all recipients. Group messages or CCs change the response.

4. In-person threats (verbal, gesture, written sign)

Less common but more immediately dangerous. The person making an in-person threat is on-site.

• Do not confront. Personal safety is the priority. Move quietly away from the threatening individual to a safe location.
• Activate the duress alarm if one is installed.
• Call 000 as soon as it is safe to do so.
• Note the person’s description. Build, height, clothing, hair, distinctive features, direction of departure if they leave.
• Lockdown rather than evacuate may be the correct response if the person is hostile and armed.
• Coordinate with police on arrival. Police take operational control.

For workplaces with elevated exposure to in-person hostility (frontline service, public-facing operations, healthcare), see our threat preparedness training.

5. Discovery of a suspect item

A “suspect item” is any object that should not be where it is and cannot be readily identified or explained. A package left next to a bin. An unattended bag in a public area. A box wired to a timer. AS 3745:2010 Appendix B explicitly addresses suspect items, and the procedure is built on four words: do not touch.

The Australian Federal Police and state police use a “4 Cs” framework for handling suspect items:

• Confirm. Is it suspicious? Is it out of place, unattended, abandoned, or showing concerning features (wires, batteries, leaking substance, unusual weight, unfamiliar smell)?
• Clear. Move people away from the item. Cordon off a minimum 100-metre radius for a hand-held parcel or larger items; further for vehicle-borne items.
• Cordon. Establish and maintain the cordon. Do not allow anyone to re-enter.
• Control. Pass control to emergency services on arrival.

Do not touch, move, cover, open, or photograph the item closely. Do not use radios or mobile phones near the item. Do not allow curious staff to “check it out”.

The decision framework: evacuate, search, partial evacuate, or stay

Once a threat has been received or a suspect item identified, the Chief Warden faces a decision with four common options. AS 3745:2010 anticipates that the response should be proportionate to the credibility of the threat and the practicality of each option.

• Full evacuation. Used where the threat is credible, the location of the device is known or suspected to be inside the building, or a suspect item has been identified. Evacuation routes are chosen to avoid the threatened area.
• Partial evacuation. Used where the threat is localised to one floor, wing, or zone. Occupants in the affected area are moved; the rest of the facility shelters or continues operations under heightened alert.
• Search without evacuation. Used where the threat is vague, not specific to the facility, or assessed as low credibility, and where trained warden teams can conduct a discreet search.
• Stay in place. Used where evacuation routes themselves are compromised, where the threat is assessed as a hoax with no specific reference to the facility, or where police have advised it.

In every case, the decision is made by the Chief Warden in consultation with police once they are on scene. The Chief Warden does not need to decide alone, and should not delay the call to police while deliberating.

Searching the building

If a search is authorised, AS 3745:2010 Appendix B describes a structured approach. Several rules govern it:

• Wardens search their assigned areas only. Wardens know their floor, zone, or department better than anyone, including police. They are looking for items that are out of place.
• Search in pairs where possible. Two pairs of eyes reduce error and improve safety.
• Search systematically. Start at the floor and work upwards (floor, low-level fittings, mid-level, ceiling, ceiling void if accessible). Standard pattern: room interior, then perimeter, then fixed fittings.
• Search public-access areas first. Reception, lobbies, public bathrooms, mail rooms, photocopier rooms, fire-stair landings. These are the locations where a planted item is most likely.
• Search up, not down. Move from lower floors to higher floors so that any found item is not above evacuating occupants.
• Touch nothing suspicious. A suspect item is reported. It is not moved.
• Report results to the Chief Warden, including the time the area was cleared.

Wardens are not bomb technicians. The objective is to identify items that are out of place, not to defuse or examine anything.

Coordination with emergency services

The Australian Federal Police, state and territory police forces, and Fire and Rescue all play roles in a bomb threat response. The handoff:

• Police take operational control on arrival for any credible bomb threat or suspect item.
• The Chief Warden briefs the senior officer on arrival. Critical information: when the threat was received, channel of delivery, exact wording, who took the report, whether a suspect item has been identified, evacuation status, presence of vulnerable occupants, locations of utilities and hazardous materials.
• Provide site information. Floor plans, evacuation diagrams, CCTV access, key safe codes, hazardous materials register.
• Cooperate with searches and re-entry decisions. Police, with the Australian Bomb Data Centre or local Explosive Ordnance Disposal teams as required, determine when the building can be re-occupied.

For terrorism-related incidents or significant threats, the National Security Hotline (1800 123 400) is available 24 hours. Suspicious activity (not an active threat) should be reported there in addition to local police.

After the threat: post-incident actions

The procedure does not end when police clear the building. Post-incident actions matter for compliance, learning, and recovery:

• Conduct a debrief within 24 to 48 hours, with the ECO, the call-taker (or recipient of the threat), facility management, and where appropriate, a police liaison.
• Document the incident. Time of receipt, channel, exact wording, response taken, decisions made, decision-makers, evacuation timeline, and outcome.
• Update the emergency plan. Lessons captured become procedural changes.
• Support the call-taker. Receiving a bomb threat can be traumatic. Make Employee Assistance Program (EAP) support available.
• Brief occupants. Once police have cleared the incident, provide a clear, calm statement to occupants. Avoid speculation.
• Report under WHS Regulations. Where applicable, notify the relevant state or territory WHS regulator. Recent (2025) model WHS amendments have extended notification duties to include certain violent incidents, with adoption varying by jurisdiction.

Training: making the procedure work under pressure

A bomb threat procedure that lives in a binder is not a procedure. It is a document. The procedure becomes real only through training, and AS 3745:2010 expects it.

• Receptionist and front-desk training specifically on phone-call handling, with the bomb threat checklist at every workstation that takes external calls.
• Warden training on suspect-item identification, the 4 Cs framework, and search discipline. See our fire warden training program.
• Chief Warden training on the decision framework, communication with police, and the evacuate-or-search judgment call. See our Chief Warden training.
• Whole-of-organisation drills that include a bomb threat scenario, not just the routine fire exercise. AS 3745 requires at least one evacuation exercise annually. Rotating scenarios across multi-year cycles is best practice.
• Specialist bomb and substance threat training for higher-risk facilities, public-facing operations, government, education, healthcare, and any organisation with a known threat profile.

First 5 Minutes has been delivering AS 3745-compliant threat preparedness training to Australian organisations for more than 30 years. Our training covers all delivery channels (verbal, written, email, in-person), all decision points (evacuate, search, shelter), and integrates with the broader Emergency Control Organisation framework.

Book bomb and substance threat training, or contact our team on 1300 321 120 to talk through your facility’s exposure and training needs.

Frequently Asked Questions

What should I do first if I receive a bomb threat?

Stay calm and do not hang up. If the threat is by phone, let the caller end the call and write down everything you can: the exact words used, the caller’s voice and demeanour, and background sounds. If the threat is written or by email, preserve the original and handle it as little as possible. As soon as the immediate threat has ended, alert the Chief Warden and call 000.

Should you sound the fire alarm during a bomb threat?

Not as the first response. A general fire alarm may move occupants directly past a suspect item. AS 3745:2010 Appendix B describes a quieter, controlled response using the PA system or runners, with routes chosen to avoid the threatened area. The Chief Warden may decide to use the alarm in specific circumstances, but it is not the default.

Why can’t you use radios or mobile phones near a suspect item?

Radio frequencies can potentially trigger certain electronic detonators. AS 3745:2010 and Australian police guidance both call for radios and mobile phones to be operated at a safe distance from the suspect item. Two-way radios used by wardens during a bomb threat response should be used outside the cordon.

What is the 4 Cs framework for suspect items?

The 4 Cs are Confirm, Clear, Cordon, Control. Confirm that the item is genuinely suspicious. Clear people from the area (minimum 100 metres for a hand-held parcel). Cordon and maintain the perimeter. Pass Control to emergency services on arrival. Under no circumstances should anyone touch, move, cover, open or closely examine a suspect item.

Does AS 3745:2010 cover bomb threats?

Yes. Appendix B of AS 3745:2010 provides guidance on planning and response for bomb threats. The standard explicitly notes that the appendix is not comprehensive enough to be a complete plan on its own, so workplaces in higher-risk industries should supplement it with specialist bomb and substance threat training and procedures tailored to their facility.

Who takes control once police arrive?

Police take operational control of any credible bomb threat or suspect item response on arrival. The Chief Warden briefs the senior officer with the threat details, evacuation status, and site information, and thereafter follows police direction. For terrorism-related matters, the Australian Federal Police and state counter-terrorism units coordinate the response.

What is Australia’s current national terrorism threat level?

Australia’s National Terrorism Threat Advisory level is currently PROBABLE, the third level on a five-tier scale (Not Expected, Possible, Probable, Expected, Certain). ASIO raised the level from “Possible” in August 2024 and has maintained it since. “Probable” means credible intelligence indicates an intent and capability to conduct an attack in Australia within the next twelve months.

Should you treat every bomb threat as a hoax?

No. Treat every threat as credible until police advise otherwise. The vast majority of bomb threats received in Australian workplaces are hoaxes, but the procedure must be followed in every case. The credibility assessment is made by police, not by the call-taker or the Chief Warden.

Are bomb threat procedures different for schools, hospitals, and government buildings?

The core procedure is the same under AS 3745:2010, but the facility-specific elements differ. Schools have additional considerations around minors and parental notification. Hospitals must consider patient mobility, clinical continuity, and AS 4083:2010. Government buildings often have specific Commonwealth or state-level protocols. Higher-risk facilities should supplement the standard procedure with tailored training.

How often should bomb threat procedures be tested?

AS 3745:2010 requires at least one full evacuation exercise per year. Best practice is to rotate scenarios across multi-year cycles so the ECO has tested bomb threat, hazmat, active threat and medical scenarios alongside the standard fire drill. Receptionists and front-desk staff should also receive separate phone-handling refreshers.

Where should the bomb threat checklist be kept?

At every workstation that may receive external phone calls (reception, switchboard, customer service, security desks, executive assistants). The checklist is most effective when it is physically next to the phone, not in a folder in a drawer. Download our bomb threat checklist for use in your facility.

Who do I report suspicious activity to in Australia?

For an immediate threat, call 000. For suspicious activity that does not need immediate police response (unusual behaviour, surveillance, suspect items already secured), call the National Security Hotline on 1800 123 400. The hotline operates 24 hours and information can be provided anonymously.