School Site Risk Management Checklist
Annual cycle a K-12 principal or district safety lead runs to identify, mitigate, and communicate operational risks across the campus — covering physical safety, FERPA and data-privacy exposure, background-check currency, drill readiness, and incident-response staffing.
Site Risk Identification
-
Walk the campus for physical hazards
Custodial supervisor and assistant principal walk the building and grounds together. Flag tripping hazards on playgrounds, locked-but-shouldn't-be exits, blocked AED cabinets, expired fire extinguishers, line-of-sight gaps in pickup/drop-off, and any unsecured chemical storage in custodial closets and science rooms.
-
Review last year's incident log and CPS call record
Pull the prior-year office referrals, nurse log, mandatory-reporter call records, and any Title IX or 504 complaints. Look for clusters — a single playground with three head-injury reports, a hallway with repeat fights — that point at structural fixes rather than student-by-student responses.
-
Audit FERPA exposure across SIS and ed-tech apps
Inventory every app teachers have students log into, plus any shared Google Sheets or Drive folders containing student PII. The classic breach is a roster spreadsheet shared link-anyone-with-the-link. Confirm SIS role-based access in PowerSchool / Infinite Campus / Skyward matches current staff assignments — terminated staff still in the access list is a finding.
Collects file -
Score each risk on the likelihood-severity matrix
Plot every identified risk on a 5×5 likelihood-severity grid. Anything landing in the red zone (Critical) gets pulled forward into immediate mitigation rather than waiting for the annual cycle. Record the highest severity score below — it drives whether the next phase opens with an emergency-mitigation step.
Collects list
Mitigation Controls and Audits
-
Address any Critical-rated risks immediately
Critical findings — exposed PII, broken exterior door locks, expired AEDs, an unbackgrounded staff member already on site — get a same-week remediation plan, not a place in the annual queue. Loop in the district risk officer and document the temporary control in writing.
-
Audit staff and volunteer background-check currency
Pull the fingerprint-clearance roster from HR and reconcile against the active staff and approved-volunteer lists. Most states require a 5-year renewal cycle; substitutes and long-term volunteers are the usual gap. Flag anyone whose clearance expires within 60 days.
Collects list -
Remediate expired background-check gaps
Pull anyone with an expired clearance from student-contact duty until the renewal completes. Coordinate with HR to schedule new fingerprinting; for volunteers, the building principal should send the renewal notice the same day. Do not allow grace periods — state ed code generally treats this as strict liability.
-
Renew Data Privacy Agreements with ed-tech vendors
Walk the approved-app list and confirm a current DPA exists for each vendor handling student data. New tools teachers adopted mid-year are the common gap — add them to the list or block them. COPPA consent path matters for any tool used by under-13 students.
-
Confirm WCAG 2.1 AA accessibility on public materials
Spot-check the school website, parent newsletter PDFs, and any video the office sends home. Captions on video, alt text on images, keyboard navigation on the site. Section 504 / ADA Title II OCR complaints have been routine in this area for a decade — finding the gaps before a complaint is the cheaper path.
Emergency Preparedness and Drills
-
Update the Comprehensive School Safety Plan
Refresh the CSSP with current staff names, room assignments, evacuation routes, reunification site, and any new structural changes to the building. State law typically requires annual board adoption — confirm the next board meeting date so the document is signed before the deadline.
-
Schedule fire, lockdown, and earthquake drills
Lay out the year's drill calendar against the bell schedule and testing windows. Most states mandate monthly fire drills plus a minimum number of lockdown and shelter-in-place exercises. Coordinate with local fire and PD before scheduling lockdown drills so the call doesn't trigger an actual response.
Collects file -
Verify EpiPen, Narcan, and Stop-the-Bleed certifications
Nurse pulls the certification roster for delegated medication administration and bleeding-control training. Most states allow non-nurse staff to administer epinephrine and naloxone with current training; confirm at least one certified responder per wing during every bell. Replace any expired stock in cabinets and go-bags.
-
Test the mass-notification system end to end
Send a test alert through InformaCast / SchoolMessenger / ParentSquare, covering robocall, SMS, email, and on-site PA. Confirm Spanish and other-language versions fire correctly — equity gaps here usually surface as families who never got the bus-route or early-dismissal notice.
Stakeholder Communication and Training
-
Deliver mandatory reporter refresher training
Every staff member — teachers, aides, custodians, coaches, volunteers — needs the refresher. Emphasize that the reporting obligation is personal: a staff member with reasonable suspicion calls CPS themselves, they do not delegate to the principal. Document attendance in Vector Solutions or Frontline.
-
Brief the Title IX team on the current framework
Title IX coordinator, investigators, and decision-makers walk through the live regulatory framework — the 2020 vs. 2024 rule status changes which procedures apply. Cover acknowledgement timelines, supportive measures, and the live-hearing requirement for higher-ed respondents if applicable.
-
Send the safety plan summary to families
Push the family-facing summary through ParentSquare with translations into the languages on the home-language survey. Include the reunification site, the visitor-management policy, and how families will be notified during an actual incident. Paper copies to families flagged as digital-only-no.
Incident Response Readiness
-
Confirm incident command roles and call tree
Walk the ICS chart with each named staff member and their backup. Common gap: the named incident commander is on a leave nobody updated the chart for. Confirm cell numbers and after-hours contacts; print the call tree and post it inside the main office, the nurse's office, and the custodial supervisor's desk.
-
Run a tabletop scenario with the response team
Pick a realistic scenario from last year's regional incidents — bomb threat by email, parent custody dispute at pickup, student overdose in a bathroom — and walk through the response in real time. Capture the gaps that surface (who has the AED key, who calls the district PIO) as action items, not as a tidy after-action.
-
Sign off on the annual risk review for the board
Principal and district safety officer co-sign the annual review packet — risk register, mitigation actions taken, drill log, training attendance. The packet goes to the board with the CSSP adoption vote. Keep a copy in the records room per the state retention schedule.
Collects signature Collects paragraph
Use this template
Copy it to your account, customize the steps, and run it with your team in minutes.
Browse hundreds of free templates across every team and industry.
Back to template libraryRelated templates
More workflows your team can run.
Run School Site Risk Management Checklist with your team
Customize the steps, assign roles, set a schedule, and keep a complete record for every run.