Worksafe New Zealand v Ministry of Social Development [2016] NZDC 12806 (9 September 2016)

Last Updated: 12 September 2016

IN THE DISTRICT COURT AT WELLINGTON

CRI-2015-085-002309 [2016] NZDC 12806

WORKSAFE NEW ZEALAND

Prosecutor

v

MINISTRY OF SOCIAL DEVELOPMENT

_Defendant(s)

Hearings:	4–13 July 2016 15 August 2016
Appearances:	D La Hood and A van Echten for the prosecutor B Stanaway and H McKenzie for the defendant
Judgment:	9 September 2016

_{RESERVED JUDGMENT OF CHIEF JUDGE JAN-MARIE DOOGUE}

Table of Contents

Executive Summary .................................................................................................[1] Background.............................................................................................................[13] The defendant .......................................................................................................[13] The Ashburton incident ........................................................................................[19] The charge ............................................................................................................[22] The law ....................................................................................................................[28] The Health and Safety in Employment Act 1992..................................................[28] The duty and offence ............................................................................................[31] Practicable steps ..................................................................................................[36] Two-stage assessment...........................................................................................[40] Was there a reasonably predictable hazard?.......................................................[50] Client-initiated violence generally .......................................................................[54] Client-initiated violence involving use of firearms ..............................................[79] Use of a weapon other than a firearm..................................................................[84] Practicability...........................................................................................................[89]

Section 2A(1)(a): The nature and severity of the harm that may be suffered if the result is not achieved ............................................................................................[90]

Section 2A(1)(b)–(c): The current state of knowledge about the likelihood that harm of that nature will be suffered if the result is not achieved, and the current state of knowledge of harm of that nature ............................................................[91] Section 2A(1)(d): The current state of knowledge about the means available to achieve the result, and about the likely efficacy of each of those means .............[96] Controlled-access barriers.................................................................................[105] Zoning model...................................................................................................... [117] Section 2A(1)(e): the availability and cost of the means ...................................[127]

Causation ..............................................................................................................[130] Conclusion.............................................................................................................[132] Result .....................................................................................................................[134]

Executive Summary

[1] At approximately 9:51am on 1 September 2014, Russell John Tully, wearing a balaclava and armed with a loaded shotgun, entered the Ashburton office of Work and Income New Zealand (WINZ), a division of the Ministry of Social Development (“the defendant”). Moving swiftly and deliberately, he shot at four employees, killing two of them. Mr Tully was subsequently found guilty of murder and sentenced by

the High Court to a term of imprisonment.1

[2] Both parties have accepted that the events which unfolded in Ashburton on 1

September 2014 have since heightened the risk of client-initiated violence in New Zealand. Security arrangements at many government offices and service providers, including the defendant, have been augmented to account for the increased risk. Furthermore, New Zealand now operates under new health and safety legislation, the Health and Safety at Work Act 2015.

[3] The task before the Court is to assess what security arrangement was appropriate at the defendant’s Ashburton office (“the Ashburton office”) on 1

September 2014. It is crucial to avoid applying the benefit of hindsight. We know now that employees did in fact face a lethal hazard. However, the appropriate question in this case is to determine whether the hazard of client-initiated violence was reasonably predictable, and if so, whether the defendant took all practicable

_{steps to address that hazard, given the knowledge available prior to the incident.}

1 R v Tully [2016] NZHC 1133.

[4] On 4 July 2016, the defendant pleaded guilty to one charge of failing to take all practicable steps to ensure the safety of employees, under ss 6 and 50 of the Health and Safety in Employment Act 1992 (HSEA 1992).

[5] The defendant accepted five of the six practicable steps which the prosecutor (“WorkSafe New Zealand”) alleged it failed to take. Those steps are set out at subparagraphs (b)–(f) of Appendix 1. However, the defendant did not accept alleged practicable step (a), namely:

(a) Ensuring there was no physically unrestricted access by clients to the staff working area;

[6] Practicable step (a) was consequently the subject of a disputed facts hearing to determine whether, prior to 1 September 2014, the defendant was required to have in place restrictions on access by clients to the staff working area at the Ashburton office. The prosecution case focussed primarily on the establishment of a physical barrier which would separate clients from employees.

[7] For the reasons set out in this judgment, I am satisfied beyond reasonable doubt that at the Ashburton office on 1 September 2014:

(a) there existed a reasonably predictable hazard of client-initiated violence involving manual assaults and assaults involving weapons (other than firearms) on WINZ employees. It was not, however, reasonably predictable at the relevant time that a lone mission- oriented gunman, such as Mr Tully, would attack Ashburton staff;

(b) the implementation of a physical barrier to delay violent clients was a reasonably practicable step open to the defendant prior to 1 September

2014;

(c) an appropriate physical barrier would have been a secured desk at the point of interaction between a client and a case manager, which would delay a client attempting to reach around or over the desk. The delay

would allow an employee to utilise a rapid route of egress to a safe zone.

[8] Under the HSEA 1992 it is not necessary for the prosecution to prove a causal link between the failure to take a practicable step and the harm suffered, although the issue of causation is of significance to sentencing. I am not persuaded beyond reasonable doubt that a physical barrier would have prevented or minimised the particular harm caused by Mr Tully.

[9] In making the findings at paragraph [7](a), I note three important points. First, where a general reasonably predictable hazard can be identified, an organisation such as the defendant must take all reasonably practicable steps to address it. Even where harm resulting from a hazard cannot be predicted as manifesting at a particular time or place, the defendant may nevertheless have an obligation to take practicable steps to address that harm. An important purpose of security planning is to prepare for the moment where a general risk may manifest as a specific violent event.

[10] Secondly, the fact that an organisation carries out a large number of interactions, only a relatively small proportion of which are violent, does not bring the hazard below the scope of reasonable predictability. In cases involving large organisations, even if only a small proportion of interactions carry a risk of violence, this may give rise to significant harm.

[11] Thirdly, I find that “situational violence” — a common feature of client- initiated violence — has the potential to arise from staff-client interactions in any location. In respect of national organisations where client-initiated violence is identified as a reasonably predictable hazard, it is important that it be considered on a nationwide basis and, where appropriate, with reference to international trends and patterns. This nationwide underlying risk may then be considered together with local and temporal variations.

[12] The findings contained in this judgment are based on a detailed examination of the experiences of, and hazards faced by, the defendant’s employees at the

material time. As such, they are not automatically applicable to other government departments. Each organisation will have its own unique experiences, which may require different means of predicting and responding to known hazards.

Background

The defendant

[13] The defendant is the Government Ministry responsible for providing income support services to New Zealanders. Under the Social Security Act 1964, the defendant has a statutory obligation to provide these services. It does so through WINZ, which is a division of the defendant Ministry. WINZ offices provide income support, help people into work and support employers. These services must be delivered within the confines of the defendant’s health and safety obligations to employees and other persons.

[14] The defendant employs 10,000 workers across over 300 sites. As at 1

September 2014, this included a WINZ office in Ashburton. The Ashburton office was located at a shared site with Child Youth and Family (CYF). The building was accessed through an entrance on Cass Street, through automatic doors into a reception area. To the right was the entrance to CYF and to the left, through another set of automatic doors, was the entrance to WINZ. The automatic doors to WINZ were often kept open during business hours. Accordingly, the public had unrestricted access into the reception area and from the reception area to the open plan space where case managers worked and met with clients.

[15] There was no mechanism to quickly lock doors into the reception area or into the working area from the reception area; they could only be locked with a key. One security guard was present at the site, although he was not trained to confront a violent client armed with a weapon.

[16] In 2012, the defendant commissioned a report concerning its own security arrangements. The lead author of that report was Mr Carlton Ruffell, an experienced security consultant. The report (“the Ruffell Report”), delivered in three phases,

assessed the defendant’s security arrangements as being of a lower standard than those of comparable government agencies. The Ruffell Report provided a number of recommendations for improvement of security at all of the defendant’s sites, including at the Ashburton office.

[17] Although the Ruffell Report rated the defendant’s security maturity as being lower than that of comparable government agencies, it concluded that some aspects of the defendant’s security were effective. The Ruffell Report found that the defendant’s security hardware was sound and followed a documented plan. All WINZ sites had at least one security guard.

[18] At the time of the Ashburton incident the defendant had begun to put in place some of the recommendations identified in the Ruffell Report. While — as the defendant’s guilty plea acknowledges — the pace of change was slow, it is clear that progress was being made.

The Ashburton incident

[19] At approximately 9:51am on 1 September 2014, Russell John Tully, wearing a balaclava and armed with a loaded shotgun, entered the Ashburton office of Work and Income New Zealand (WINZ), a division of the Ministry of Social Development (“the defendant”). Moving swiftly and deliberately, he shot at four employees, killing two of them. Mr Tully was subsequently found guilty of murder and sentenced by the High Court to a term of imprisonment.

[20] Mr Tully’s attack followed a series of interactions in which Mr Tully had been provided some assistance from WINZ employees. Many of his requests were declined on the grounds that they fell outside his legally-prescribed entitlements. He was declined funds to purchase a bicycle and was issued only a recoverable accommodation grant, rather than an ex gratia payment. Mr Tully acted aggressively in response, and was consequently issued with a trespass notice.

[21] In sentencing Mr Tully for murder, Mander J in the High Court found that Mr Tully had developed a sense of grievance over the way he perceived he had been treated by WINZ employees. He commented that:2

[8] There was nothing random in your actions that morning. You had developed a sense of grievance over the way you perceived you had been unfairly treated by WINZ staff over the course of the preceding months. Concern about the nature of your interaction with staff culminated in you being trespassed from the premises.

[9] You set upon a plan to deliberately target WINZ employees who had dealt with you and with whom you had developed some form of grudge. You entered the WINZ office that morning with the intention of killing these people. You made the necessary preparations to carry out this plan, including arming yourself with a shotgun, disguising yourself and assembling your kit for the purpose of evading capture.

The charge

[22] On 2 March 2015, the prosecutor charged the defendant with one offence under the HSEA 1992 ss 6 and 50(1)(a), namely:

It being an employer, failed to take all practicable steps to ensure the safety of its employees while at work, in that it failed to take all practicable steps to ensure that they would not be exposed to the hazard of violent clients.

[23] The defendant pleaded guilty to the charge and accepted that it failed to take practicable steps (b)–(f) (as set out at Appendix 1). However, the defendant did not accept alleged practicable step (a).

[24] Practicable step (a) is worded broadly, although within prosecutorial discretion.3 I note, however, that in this case the broad phrasing of the step resulted in difficulties in determining exactly what was meant by “ensuring there was no

_{physically unrestricted access”.}

[25] Ultimately, the core element of the alleged practicable step is some form of physical barrier between employees and clients to delay the advance of a violent client. While the prosecutor is not required to prove the precise requirements of the

_{physical barriers or control mechanism, the prosecutor is required to provide a broad}

2 _{At [8]–[9].}

3 WorkSafe New Zealand v Waimea Sawmillers Ltd [2015] NZDC 21082 (Waimea Sawmillers DC)

at [39]–[40].

cogent explanation of the architectural security model that it alleges was reasonably

_practicable.4 _{Failure to do so will inevitably cast doubt on the prosecution case.}

[26] I need to be sure that restricting access to the staff working area at the

Ashburton office with some form of physical barrier was a reasonably practicable step for the defendant to have taken prior to 1 September 2014.

[27] While the focus of the charge itself is the Ashburton office, the defendant’s nationwide position may still be of relevance. National organisations such as the defendant may be required to incorporate organisational data and international trends when predicting local risks. This approach follows the decision in WorkSafe v

Waimea Sawmillers Ltd (Waimea).5

The law

The Health and Safety in Employment Act 1992

[28] It is necessary to consider whether alleged practicable step (a) meets the definition of a practicable step set out in the HSEA 1992, s 2A.

[29] The HSEA 1992 is an enabling and preventative piece of legislation. It assigns ownership of workplace health and safety (and other responsibilities) to employers and others. Rather than establish minimum standards for workplace safety, the Act imposes the standard of “reasonableness” in respect of those obligations by requiring a systematic approach to the management of workplace hazards. The definition of a hazard is set out in s 2 of the Act and includes a person’s behaviour:

hazard—

(a) means an activity, arrangement, circumstance, event, occurrence, phenomenon, process, situation, or substance (whether arising or caused within or outside a place of work) that is an actual or potential cause or source of harm; and

4 _{WorkSafe New Zealand v Ministry of Social Development [2016] NZDC 12562 at [26].}

5 Waimea Sawmillers (DC), above n 3, at 111; upheld in WorkSafe New Zealand v Waimea

Sawmillers Ltd [2016] NZHC 915 (Waimea Sawmillers HC).

(b) includes—

(i) a situation where a person’s behaviour may be an actual or potential cause or source of harm to the person or another person; and

(ii) without limitation, a situation described in subparagraph (i) resulting from physical or mental fatigue, drugs, alcohol, traumatic shock, or another temporary condition that affects a person’s behaviour.

[30] In relation to the proper interpretation of the Act, higher courts have stated that:6

• The principal object of the Act is to provide for the prevention of harm.

• Employers are required to promote safety in the workplace and to take all practicable steps to ensure employees and others in the workplace are not harmed.

• While the primary obligation to promote and ensure safety rests upon the employer, this does not exonerate or diminish the responsibility of other persons in other capacities recognised in Part

2 from discharging the statutory duty imposed upon them.

• There is no valid distinction to be drawn between a positive duty to act and a negative duty to avoid harm.

• The question of what is a practicable step to ensure safety in the workplace is a matter of fact and degree in each case.

The duty and offence

[31] The relevant duty in this case is s 6 of the HSEA 1992, which provides that:

6 Employers to ensure safety of employees

Every employer shall take all practicable steps to ensure the safety of employees while at work; and in particular shall take all practicable steps to—

(a) provide and maintain for employees a safe working environment;

and

(b) provide and maintain for employees while they are at work facilities for their safety and health; and

6 Department of Labour v Hanham and Philp Contractors (2008) 6 NZLER 79, (2009) 9 NZELC

93, 095 (HC) at [22]; citing Central Cranes Ltd v Department of Labour [1997] 3 NZLR 694 (CA) at 701.

(c) ensure that plant used by any employee at work is so arranged, designed, made, and maintained that it is safe for the employee to use; and

(d) ensure that while at work employees are not exposed to hazards arising out of the arrangement, disposal, manipulation, organisation, processing, storage, transport, working, or use of other things—

(i) in their place of work; or

(ii) near their place of work and under their employer’s control;

and

(e) develop procedures for dealing with emergencies that may arise while employees are at work.

[32] Failure to comply with the s 6 duty constitutes an offence under s 50(1)(a) of the HSEA 1992. Section 53 of the HSEA provides that proof of intention to take an action, or not to take an action, is not required to prove that an offence was committed under s 50. Even an inadvertent failure to take all practicable steps may

give rise to liability.7

[33] It is well established that to prove that the s 6 duty was breached, it is not necessary to establish a causative link between failure to take an alleged practicable step and any harm suffered.8

[34] The preventative nature of the HSEA 1992 means that a charge may be proven without any harm being incurred.9 Causation will, however, be relevant to sentencing. Section 51A requires the sentencing court to consider the “degree of

_{harm, if any, that has occurred” as a result of the breach of the duty.}

[35] A Crown organisation — such as the defendant — may be prosecuted for offences under either ss 49 or 50 of the HSEA.10 The defendant may be ordered to

_{pay reparation, compensation or costs but cannot be sentenced to pay fines.}11

7 _{Linework Ltd v Department of Labour [2001] NZCA 125; [2001] 2 NZLR 639 (CA) at [39].}

8 _{Waimea Sawmillers (HC), above n 5, at [38]; Waimea (DC), above n 3, at [36].}

9 _{Waimea (DC), above n 3, at [36].}

10 _{Crown Organisations (Criminal Liability) Act 2002 s 6 (as at 1 September 2014).}

11 Section 12.

Practicable steps

[36] The phrase “practicable steps” found in s 6 is further defined in s 2A of the

HSEA 1992 as follows:

(1) In this Act, all practicable steps, in relation to achieving any result in the circumstances, means all steps to achieve the result that is reasonably practicable to take in the circumstances, having regard to—

(a) the nature and severity of the harm that may be suffered if the result is not achieved; and

(b) the current state of knowledge about the likelihood that harm of that nature and severity will be suffered if the result is not achieved; and

(c) the current state of knowledge about harm of that nature; and

(d) the current state of knowledge about the means available to achieve the result, and about the likely efficacy of each of those means; and

(e) the availability and cost of each of those means.

(2) To avoid doubt, a person required by this Act to take all practicable steps is required to take those steps only in respect of circumstances that the person knows or ought reasonably to have known.

[37] Because the question of practicability must be assessed differently in each case, the factors set out at s 2A of the HSEA 1992 may assume different relative significance depending on the circumstances before the Court. In the present case, the reference to “any result in the circumstances” may be read as a reference to satisfying the duty contained in s 6, ensuring the safety of employees while at work.

[38] As to what “practicable” means, Baragwanath J in Department of Labour v Solid Timber Building Systems New Zealand12 cited the House of Lords decision in Marshall v Gotham Co Ltd:13

I think it enough to say that if a precaution is practicable it must be taken unless in the whole circumstances that would be unreasonable. And as men’s

12 _{(2004) 7 NZELC 98, 763 (HC).}

13 [1954] AC 360 at 373 (UKHL).

lives may be at stake it should not lightly be held that to take a practicable precaution is unreasonable.

[39] As noted by the High Court in Waimea:14

The Act does not require an employer to ensure complete protection of an employee. Rather, the Act imposes an obligation on an employer to take all reasonably practicable steps to guard against potential hazards. Whether a practicable step has been taken cannot be determined with the benefit of hindsight or on what was known after the event. The relevant point in determining what is practicable is a point in time immediately prior to the incident.15

Two-stage assessment

[40] Read in the context of the HSEA 1992, the s 6 duty places a twofold obligation on employers. I agree with and adopt the analysis of Judge Morris in Waimea Sawmillers:16

... the section places an obligation on employers to make an assessment of their workplace and to identify any process or object that could potentially cause harm to an employee. Once such a hazard is identified however, there is not an absolute requirement to eliminate them all. That would be impossible. What the employer does have to do, however, is stand back once a hazard is identified and consider what are all the practicable steps that can be taken to eliminate the hazard, if that is possible, or reduce the risk as far as is reasonable. In a similar vein, the employer does not have to predict that which is not reasonably predictable ...

[41] The relevant questions can essentially be summarised as follows:17

(a) Whether a hazard existed and whether an organisation ought reasonably to have predicted it; and

(b) If so, whether at least one of the alleged practicable steps relied on by the prosecution is a reasonably practicable step that the employer

_{should have taken to reduce the risk of harm from the hazard.}

14 _{Waimea (HC), above n 5, at [36].}

15 _{Buchanans Foundry Ltd v Department of Labour [1996] 3 NZLR 112 (HC) at 342.}

16 _{Waimea (DC), above n 3, at [27]. This decision was upheld by the High Court.}

17 At [88].

[42] Once the answer to the first question has been established, the prosecution must prove the reasonable practicability of the steps alleged. This involves an assessment of risk, and the means required to address that risk. As noted by the House of Lords in Edwards v National Coal Board (recently cited with approval by the High Court in Waimea):18

... the quantum of risk is placed on one scale, and the sacrifice involved and the measures necessary for adverting the risk, whether in money, time or trouble, is placed on the other;

[43] The “quantum of risk” refers to the risk of harm arising from the relevant hazard. Where the quantum of risk is low, but the measures necessary for averting the risk are significant, then the practicability of the step may not be proven. The factors listed in s 2A(1) guide the assessment of risk and measures necessary for averting the risk.

_{[44] In assessing the predictability of the hazard and the quantum of risk, it is}

_{important to take a “macro” approach.}19

_{This requires an assessment of all}

circumstances. For example, it will be necessary to consider the hazard prior to the incident that triggers the prosecution investigation, and to employees at the place of work other than those who were the victims of that incident. In the case of organisations such as the defendant, which operate nationwide, any meaningful risk

_{assessment must account for any underlying risk faced across all its places of work.}

[45] This approach is consistent with the decision of the Industrial Court of New South Wales in Cahill v State of New South Wales, where the Court observed that it would be inappropriate to work back “from the actual incident with the benefit of hindsight” and in effect “narrow the risk to a degree of preciseness which was

_{impermissible”.}20

18 Edwards v National Coal Board [1949] 1 KB 704 at 712; cited in Waimea Sawmillers (HC), above n 5, at [35].

19 _{Waimea (DC), above n 3, at [111]; Waimea (HC), above n 5, at [58]–[61],}

20 Cahill v State of New South Wales (Department of Community Serivces) (No 3) [2008] NSWIRComm 123 at [301], citing State of New South Wales (NSW Police) v Inspector Covi [2005] NSWIRComm 303 at [26].

[46] Thus, even where harm resulting from a hazard cannot be predicted as manifesting at a particular time or place, the defendant may nevertheless have an obligation to take practicable steps to address the harm caused by that hazard.

[47] The state of knowledge about the likelihood and nature of the harm is relevant and included in factors s 2A(1)(b)–(d). “Knowledge” in the definition of all practicable steps refers to an objective body of knowledge, not a defendant’s subjective knowledge.21

[48] The test of what is reasonably practicable in the circumstances is objective. It is not whether the defendant actually foresaw the potential hazard or whether it deemed the alleged practicable steps to be reasonable, but whether it was objectively reasonable to predict the potential hazard and take those steps.

[49] Cost is a relevant factor and is included in s 2A(1)(e). It has long been held that in order for cost to outweigh the risk of harm, the cost must be “grossly disproportionate” to the risk.22

Was there a reasonably predictable hazard?

[50] In ascertaining whether client-initiated violence was a reasonably predictable hazard filed by the defendant’s employees prior to 1 September 2014, it is crucial to avoid the benefit of hindsight. We know now that employees did in fact face a lethal hazard. However, the appropriate question to determine at this stage is whether the hazard of client-initiated violence was reasonably predictable prior to the Ashburton incident.

[51] At times it was difficult to determine the nature of the hazard alleged by the prosecution. The hazard was sometimes expressed as a lone mission-oriented

_{gunman (such as Mr Tully). At other times, the alleged predictable hazard was a}

21 _{Solid Timber, above n 12, at [35]–[41].}

22 Edwards, above n 18, at 712; see also Martin Simmons Air Conditioning Services Ltd v Department of Labour HC Auckland CRI-2007-404-00249, 30 April 2008. Since the Ashburton incident, this standard has been codified in the Health and Safety at Work Act 2015 s 22(e).

hypothetical client carrying out a manual assault, or an assault with a weapon other than a firearm.

[52] For the reasons set out below, while I do not consider that a lone mission- oriented gunman was a reasonably predictable hazard, I am sure that the defendant ought reasonably to have predicted a client carrying out a manual assault, or possibly an assault a weapon other than a firearm, prior to 1 September 2014.

[53] I will first assess the general hazard of client-initiated violence, before considering whether an organisation such as the defendants would have reasonably predicted violence involving firearms, or other weapons.

Client-initiated violence generally

[54] The prosecution submitted that client-initiated violence was a reasonably predictable hazard faced by the defendant’s employees. Evidence in support of this submission was provided by Mr Roger Kahler and Mr Russell Joseph. Mr Kahler is a Director and Principal Engineer of InterSafe Group Australia, which investigates approximately 450 major accidents across the world each year. Mr Joseph is a former senior policeman who has worked as a security advisor to government departments, including the Accident Compensation Corporation (ACC). The evidence of Mr Kahler and Mr Joseph was countered by the evidence of the defence expert Mr Robert Robinson. Mr Robinson is a security consultant and former Commissioner of Police of New Zealand.

[55] All three witnesses were well-qualified, although each brought different expertise to the case. Mr Kahler had vast experience advising on health and safety matters for large-scale clients across the world. He exhibited a thorough understanding of health and safety and security theory, including risk assessment and reduction. However, it should be acknowledged that Mr Kahler’s knowledge of Ashburton, and New Zealand generally, was limited.

[56] Mr Joseph had considerable experience in providing safety advice to New

Zealand government departments. He had experience dealing with the only prior

New Zealand incident of a fatality arising from client-initiated violence against a government employee.23

[57] Mr Robinson, along with the prosecution witness Mr Murray Jack, had the most thorough knowledge of this particular case. His knowledge derived from his involvement in authoring two reports on the Ashburton incident (“the Robinson/Jack Reports”). As a former Commissioner of Police and a security consultant, Mr Robinson also possessed expertise in understanding the risk associated with client- initiated violence. I note, however, that the conclusions reached by Mr Robinson in the Robinson/Jack Reports were contradicted by the guilty plea in the present case. Despite this inconsistency, I accept that the Robinson/Jack reports were truly independent and that their findings were not influenced by the defendant.

[58] Mr Kahler’s opinion was that where there exists a hazard which may cause fatal or permanent harm to employees, it is not appropriate to assess the risk of harm deriving from the hazard solely on the basis of local qualitative or quantitative metrics. Instead, the assessment should incorporate the organisation’s nationwide experience, and overseas trends. Even where a potential hazard is likely to be “rare” (that is, it may occur only in exceptional circumstances) the severity of the potential incident requires that it form the basis on which to design security controls. In his evidence and his report on the Ashburton incident (“the Kahler Report”), Mr Kahler based his assessment of predictability on international trends in the field of security risk management, as well as the defendant’s own experience and data.

[59] Mr Kahler cited overseas academic studies, including materials produced by the International Labour Organisation. Those studies revealed a global trend of client-initiated violence directed at service organisations. Mr Kahler provided an extract from a 2000 Australian study (“the Mayhew Report”) which suggested that:24

Client-initiated violence is committed by an individual who has, or has had, a service relationship with the victim or the victim’s organisation. The incident may involve (a) a “one-off” physical act of violence that results in a fatal or non-fatal injury or no obvious injury; or (b) some form of threat or

23 This was the stabbing of Ms Janet Pike at the Henderson Office of the Accident Compensation

_{Corporation (ACC).}

24 C Mayhew Preventing Client-Initiated Violence: A Practical Handbook (Australian Institute of

Criminology and Public Policy, Canberra, 2000) at 2.

verbal abuse. ... Some commentators delineate between two basic types or perpetrators: clients with a violent history who can be expected to be aggressive such as prison inmates, and clients who are “situationally” violent, for example when they are frustrated by delays of service or refusal of benefits ...

The consistent pattern evident in the data from the United Kingdom, the United States and Australia is that client-focused jobs that involve a lot of face-to-face contact are at high risk ...

Jobs and workplaces in which there is a high risk of client-initiated violence include:25

... jobs that require workers to handle money or valuables; carry drugs or have access to them; provide care and services to people who are distressed, fearful, ill or incarcerated; relate to people who have a great deal of anger, resentment and feelings of failure, or who have unreasonable expectations of what the organisation and the worker can provide; carry out inspection or enforcement procedures; or work alone.

[60] The extracts of the Mayhew Report provided by Mr Kahler demonstrated that many organisations similar to the defendant (or with a similar client base) in Australia, the United Kingdom and United States experienced significant rates of client-initiated violence. The report specifically noted risks to community and welfare workers, social workers and social housing service employees. In some cases this violence was accompanied by the use of firearms. The perpetrators’ violence generally fell into the two categories identified in the Mayhew Report: those with identifiable violent histories, and those who become “situationally” violent following, or in the course of, denial of service or welfare entitlements. Situationally violent clients were a particular risk in service divisions such as WINZ or CYF, where the organisation was essentially tasked with determining the person’s

livelihood or family arrangements. The Mayhew Report suggested that:26

Close examination of data patterns is necessary to identify risk patterns and hence appropriate prevention strategies. For example, the potential for violence may increase at particular times of the day or night, on specific days of the week, at venues where there is an excessive alcohol intake, or if there are client waiting times in excess of 20 minutes. Once correlated variables have been identified, intervention strategies can be implemented and monitored.

25 LJ Warshaw and J Messite “Workplace violence: preventive and interventive strategies” (1996)

_{38(10) J Occup Environ Med 993 at 999.}

26 Mayhew, above n 24, at 10.

[61] The defendant has clients who may become situationally violent. The nature of its business is to provide basic welfare entitlements to clients who may not have anywhere else to turn. Indeed, for some clients, WINZ support is their livelihood. WINZ employees have relatively little room for flexibility or negotiation: they must follow the relevant legal requirements and criteria to determine client entitlements. There will therefore be occasions where employees are required to decline benefits on grounds that may be perceived as unsatisfactory or unfair by the client, in circumstances that relate to the client’s essential livelihood.

[62] A similar observation was made by the Industrial Court of New South Wales in Cahill.27 The Court accepted evidence that in the context of the New South Wales Department of Child Services (DOCS), clients may become situationally violent because of the nature of the interactions with the agency: that agency’s role is to “interfere in the most sacred part of anyone’s life”, and there is little room for

_{flexibility or negotiation.}28 _{The defendant shares these features.}

[63] Mr Robinson substantially agreed with Mr Kahler’s characterisation of the hazard. He agreed that the hazard often manifested as “situational”: that is, it arose from dissatisfaction with service or denial of welfare entitlements; and often

_{occurred in the course of client interaction with employees.}

[64] Having examined international trends, Mr Kahler then focussed on the nationwide position of the defendant. In line with the suggestion from the Mayhew Report, he provided analysis of the defendant’s datasets, drawing from the defendant’s security incident reporting database (known as “SOSHI”). The SOSHI recording system categorised incidents as critical, serious, moderate or minor. Critical incidents involved: death; injury requiring hospitalisation; bomb threats; arson; burglary; theft in excess of $5000; and unauthorised access to the defendant’s information systems. Serious incidents included: physical assault requiring medical attention; threats involving self-harm; harmful substances; intimidation with intent to harm; stalking of specific employees; attempted arson; and various property-related

_incidents.

27 _{Cahill, above n 20, at [307].}

28 At [307].

[65] The SOSHI dataset revealed that there had been 13,993 security incidents in the period 3 June 2008 – 31 August 2014 across all of the defendant’s departments.

1295 of these incidents occurred in the Canterbury Region, and 31 in Ashburton. The data included 986 serious or critical incidents, 97 of which occurred in Canterbury and two in Ashburton (although it appears that one of those events may have in fact occurred in Timaru). Ashburton staff had been exposed to nine threats to kill.

[66] I accept that evidence of the experts that the SOSHI dataset likely understates the frequency of security incidents, due to systemic underreporting by employees. For example, an internal Ministry memorandum noted that of the 2000 security incidents that occurred in 2011, only 75 were reported.

[67] Mr Kahler concluded that “these ‘likelihoods’ are very high and indicative of a ‘top’ event i.e. a Critical Incident involving a fatality ... there was opportunity to predict this type of ‘top event’ based on MSD’s experience and available industry data”. Essentially, the Ministry’s dataset confirmed that international trends of client- initiated violence were evident in New Zealand. An examination of the specific events highlighted by the prosecution, and summarised below at [81] and [84], clearly suggests that this client-initiated violence was in line with international trends of situational aggression.

[68] The predictability of the hazard is reinforced by the 2012 findings of the Ruffell Report. In his assessment of security risks faced by the defendant at that time, Mr Ruffell concluded that the most “serious yet likely threat” faced by the defendant was a “lone, mission-oriented personality using a weapon to attack staff or clients”. Accordingly, the defendant had been advised that client-initiated violence was a reasonably predictable hazard prior to 1 September 2014.

[69] Mr Boyle, the defendant’s chief executive, accepted that the hazard of client- initiated violence was at least foreseeable and had materialised prior to 1 September

2014. He accepted that there had been a number of violent incidents directed against the defendant’s employees, and that this was inevitable for an organisation with a high volume of transactions and many vulnerable and disenfranchised clients. Mr Ablett-Hampton, the defendant’s Chief Legal Advisor, also acknowledged the

“foreseeability” of client-initiated violence in an interview shortly after the

Ashburton incident.

[70] Although the charge has been particularised to the Ashburton office, I accept Mr Kahler’s evidence that risk should be assessed with recourse to international trends and the organisation’s nationwide data. These factors should be considered together with the local context. The three streams of information, taken together, provide the most thorough and appropriate matrix for assessing the predictability of a hazard. If the local data were assessed in isolation it would not be possible to situate small places of work, such as the Ashburton office, in the wider framework of national and international trends. These trends put the relatively low volume of security incidents in Ashburton prior to 1 September 2014 in the appropriate context. That context is client-initiated situational violence directed at service employees. If the context is not identified, and each security incident is seen only as an isolated local event, it is not possible to predict the hazard or take steps to address it.

[71] The relevance of security information and data beyond the Ashburton office was accepted by Mr Boyle, who acknowledged in cross-examination that nationwide data was necessary in order to “make a determination on likelihood and predictability”. Indeed, Mr Boyle acknowledged that it would be inappropriate for “risk appetite” to be set with reference only to individual offices.

[72] Critical and serious incidents had been occurring with some frequency prior to 1 September 2014. SOSHI data suggests a critical incident was occurring once each month, and a serious incident three times each week. In December 2013 alone, the defendant recorded three actual assaults, 30 threats of violence and 153 incidents of abusive behaviour. The prevalence of threats to kill was also of considerable concern, although I accept the defence submission that not all of those threats were directed at employees. The defendant’s current General Manager of Health, Safety and Security, Ms Melissa Gill, accepted that manual assault accounted for 1.1% of all historic SOSHI security incidents. I am satisfied that this amounts to a sufficiently frequent and predictable occurrence.

[73] The evidence clearly points to a nationwide hazard of client-initiated violence, directed against service employees, in line with international trends. The evidence is less clear as to whether it was reasonably predictable that the hazard would manifest at the Ashburton office. Although the prosecution provided quantitative data on the number of incidents occurring in that office, there was little analysis of that data. For example, the prosecution did not identify any underlying trends or patterns in the Ashburton data, or identify whether the types of incidents occurring were in line with specific national and international trends. The shortcomings in the prosecution approach were apparent in the prosecution’s introduction of fresh analysis of SOSHI data during their closing argument, that analysis having apparently been briefly conducted that same morning.

[74] The defence provided some assertions that the particular circumstances in Ashburton rendered the hazard less predictable than elsewhere in New Zealand. Mr Stanaway suggested that at time of the Ashburton incident, Ashburton was a “prosperous market town”, evidenced by the “dairy boom” and the fact that businesses such as McDonald’s had been established. In his evidence, Mr Boyle noted that a substantial number of Ashburton WINZ clients (and indeed WINZ clients generally) were superannuitants, presumably less capable of carrying out acts of violence. I note, however, that the assertions relating to the specific risk prior to 1

September 2014 are countervailed by an observation contained in an internal Ministry of Social Development memorandum, which observed that “emerging policy initiatives” posed an increase risk of strain on, and consequent violence from, clients.

[75] I am sure that the hazard of client-initiated situational violence was reasonably predictable in relation to the Ashburton office. The nature of the hazard faced by staff at the Ashburton office followed the same general pattern as that identified in the Mayhew Report, and faced across all WINZ offices: situationally violent offenders who could become frustrated at denial of service or delays. The service provided at the Ashburton office was essentially the same service provided at all other WINZ offices. The fact that between June 2008 and August 2014 the Ashburton office had experienced 31 security incidents, including nine threats to kill, illustrates that it faced the same underlying hazard. When those 31 threats are read

together with the international and national patterns of client-initiated violence, the predictability of the hazard becomes apparent.

[76] In finding that client-initiated violence was a reasonably predictable hazard, and in light of all the evidence, I do not find that the precise date or manifestation of the hazard could possibly have been pinpointed. That is the nature of situational violence. I accept the evidence of Mr Boyle that risk prediction models used by the defendant since 2014 have only a 20% success rate in identifying a particular perpetrator of violence. I do not accept that Mr Tully’s particular actions on 1

September 2014 could have been predicted. However, as Mr Joseph observed, an important purpose of security planning is to prepare for the moment where a general risk may manifest as a specific violent event.

[77] As Mr Boyle noted, the number of serious and critical incidents experienced by the defendant’s employees constituted a very small proportion of interactions between staff and clients, in the context of the large scale of the defendant’s interactions. Mr Boyle observed that the defendant carried approximately 8000 interactions with clients every day. However, I do not accept that this observation brings the hazard below the scope of reasonable predictability. I find that the fact that the defendant carried out a significant number of interactions with clients meant that the risk of client-initiated violence was heightened, not reduced. In the context of such a large organisation, even if a very small proportion of interactions resulted in violence, this still constituted a hazard to employees.

[78] While the actions of clients with violent histories may be predicted with some specificity and regional variation, the nature of client-initiated situational violence is that it has the potential to arise out of staff-client interactions in any location of a service organisation that (a) matches the underlying patterns identified in the Mayhew Report (providing essential services to vulnerable clients); and (b) has organisational data or experience which bears out the existence of the hazard. It is therefore important that it is considered on a nationwide basis. Although it is conceivable that the hazard could be excluded in respect of specific offices on the basis of location-specific evidence, there is no reason to suggest in this case that the Ashburton office was immune from client-initiated situational violence.

Client-initiated violence involving use of firearms

[79] The prosecution further submitted that it was predictable that client-initiated violence might manifest as a lone mission-oriented gunman. I do not accept this submission. Gun violence was rare at the relevant time, particularly in comparison to jurisdictions cited by the prosecution (such as the United States). As noted by Mr Robinson, prior to the Ashburton incident New Zealand had never experienced the murder of a government service employee by the use of a firearm. Mr Robinson (who had visited the scene of many New Zealand workplace murders) observed that prior to the Ashburton incident there had been only three active shooter events on commercial or government premises: one at a Returned Service Association club, and two at banks. Neither was an organisation comparable to the defendant, and the frequency of the incidents was far lower than in overseas jurisdictions.

[80] Even if I were to accept unreservedly the application of overseas trends, I am not convinced that Mr Kahler’s evidence established beyond reasonable doubt that a lone mission-oriented gunman was reasonably predictable. The extracts of studies — such as those from the Mayhew Report — provided in Mr Kahler’s brief of evidence refer generically to client-initiated violence. They lack refinement and analysis: they do not specifically address the predictability of gun-violence directed at government service organisations. Although more specific extracts from studies were referred to in the prosecution’s closing argument, these extracts were not provided prior to the hearing and were not examined at the disputed facts hearing. It would therefore be unfair to rely on them.

[81] Turning to the defendant’s experience of violence, I note that the defendant had never experienced an incident of gun-related violence. During closing submissions, the prosecution referred to seven threats to kill with a firearm between

2009–2013, which were recorded on the SOSHI database (classed as either “moderate” or “serious” events). These events were often related to perceived unfairness or denial of welfare entitlements.

[82] However, the prosecution has not presented any evidence that a firearm was ever brought onto one of the defendant’s sites, let alone discharged. As noted by Mr

Boyle, there were no incidents of actual gun violence at any government service delivery site in New Zealand prior to the Ashburton incident. The strength of the evidence does not extend to a local or nationwide pattern which suggests that firearms, absent to a specific threat, were a reasonably predictable hazard facing the Ashburton office prior to this event.

[83] Nor do I accept that the interactions of Mr Tully with Ashburton office staff prior to 1 September 2014 gave rise to a heightened predictability of his carrying out a mission-oriented attack with a firearm. Although I note that Mr Tully’s history with the defendant met the pattern of client-initiated violence, it was not reasonably predictable that such violence would manifest through the use of firearms. Mr Tully had made no threats against employees, let alone threats relating to firearms. Mr Tully made only one statement to the defendant’s employees regarding firearms: that he felt uncomfortable because his landlord had access to a gun. While his behaviour may have been aggressive — and was sufficient for the defendant to issue a trespass order — the possibility of the use of firearms was not apparent.

Use of a weapon other than a firearm

[84] I find, however, that a reasonable employer would have predicted the hazard of client-initiated violence delivered by a weapon other than a firearm. Unlike attacks using firearms, there had been assaults on government service providers using weapons prior to 1 September 2014. The most serious of those involved the murder of Ms Janet Pike at the ACC Henderson Office in 1999. In 2005, one of the defendant’s employees was stabbed. The prosecution extracted the following incidents from the SOSHI database, all involving weapons:

• A 2009 incident where a client entered a WINZ Dunedin office with a knife strapped to his thigh;
  

• A 2009 incident where a client brought a hammer to a WINZ

interview and threatened to harm WINZ employees;

• A 2010 incident where a client brought a spanner to an interview;

• A 2010 incident where concern was raised about a client who had a knife attached to his keyring;
  
• A 2010 incident where a knife was confiscated from a client and an altercation ensued;
  
• A 2010 incident where a client attempted to attack a case manager with a stick, and instead struck a security guard;
  
• A 2010 incident of a client yelling abuse at staff while brandishing a broom handle;
  
• A 2011 incident where a client brought an open Swiss army knife into a reception area;
  
• An intoxicated client who was found to have a bottle and a knife in his bag; and
  

• A client who concealed a knife in his bag.

[85] The prosecution also provided evidence that in July 2012, a CYF client in Palmerston North attempted to smash through a partition with a blunt wooden object. As with the threats of gun-violence, a close examination of these events reveals that many occurred as a result of dissatisfaction with service or in response to denial of welfare entitlements. In some of these instances, the response or threat of violence occurred immediately after the dissatisfaction arose, and the client happened to be armed. In other cases, weapons were brought into places of work on a separate occasion following the denial of a benefit, with the intention of carrying out assaults or threats of assault with that weapon.

[86] The predictability of weapons other than firearms was disputed by Mr Robinson. He noted that the majority of security incidents involving clients recorded on the SOSHI database involved verbal abuse, or assault without a weapon. He further based his opinion on the fact that because the nature of the violence was

situational, and often arose in the course of interaction between clients and employees, clients were unlikely to have sufficient premeditation to be armed with a weapon at the point of aggression.

[87] I do not consider Mr Robinson’s opinion to be borne out on the facts before me. While it is clear that most incidents of client-initiated violence do not involve weapons, the assessment here is what hazards were reasonably predictable such that the defendant was required to control for them. Fundamentally, there had been sustained incidents of clients acting aggressively, and clients having access to weapons other than firearms. I acknowledge that many instances of situational violence will arise in the course of interaction with employees. In some of those cases it is plausible that the client may already have a weapon — such as a Swiss army knife or a bottle — on their person or close by. In other cases, the client may have become situationally violent because of a previous incident, and returned with a weapon.

[88] I am satisfied that incidents such as those referred to at [84] bear out a sufficient pattern of client-initiated violence involving the use of weapons other than firearms. Unlike threats involving firearms, prior to 2014 there had been several incidents of other weapons actually being brought into the defendant’s places of work. In some cases, they had been used to carry out attacks. The fact that these weapons were available to clients, who were willing to use them, clearly points to a higher level of predictability.

Practicability

[89] Having found that there was a reasonably predictable hazard, I must now assess whether practicable step (a) was a practicable step that the defendant was required to take. In doing so, I must consider and weigh the quantum of risk generated by the hazard against the practicability of addressing it, having regard to the factors set out in s 2A of the HSEA 1992.

Section 2A(1)(a): The nature and severity of the harm that may be suffered if the result is not achieved

[90] Having established that the relevant hazard is manual assault, or assault with a weapon other than a firearm, directed by clients against employees, it is clear that the nature of the harm is serious. Assault of this kind could cause significant personal injury. Indeed, as evidenced by the 1999 ACC stabbing, it could even result in a fatality. The seriousness of the harm is relevant to the other stages of the s 2A analysis: the more severe the potential harm, the more comprehensive the

precautions required to address it.29

Section 2A(1)(b)–(c): The current state of knowledge about the likelihood that harm of that nature will be suffered if the result is not achieved, and the current state of knowledge of harm of that nature

[91] The current state of knowledge is to be assessed not on the basis of hindsight, but on the information available prior to 1 September 2014, including expert knowledge. It includes knowledge that was objectively available at the time, whether or not it was subjectively known to the defendant.30

[92] All witnesses adopted the framework of “design basis threat” (DBT) to guide the likelihood of harm assessment. The phrase was defined in the Ruffell Report as “the most serious and likely physical threat” that the defendant was required to account for. Both parties discussed three levels of classification: DBT1 (manual assault); DBT2 (assault with a weapon other than a firearm); and DBT3 (assault with a firearm).

[93] I am satisfied that the “state of knowledge about the likelihood that harm of that nature and severity will be suffered” was at the level of DBT2. I reach this conclusion for the following reasons:

_{• As noted in paragraphs [50]–[88], the hazard was reasonably predictable.}

29 _{Mazengarb’s Employment Law (LexisNexis, online ed) at [6002A.8.2].}

30 Solid Timber, above n 12, at [35].

• The Ruffell Report demonstrates that prior to 1 September 2014, the defendant possessed actual knowledge that the hazard of attack with a weapon was a “likely threat”.

• Nationally, frontline employees were experiencing a critical incident once each month and a serious incident three times each week.

• There had been numerous instances of clients threatening to bring and use weapons, actually bringing weapons onto sites and prior instances where weapons had been used.31

• Ashburton office employees had experienced a number of threats of violence and incidents involving aggressive behaviour, suggesting that they were at the same underlying risk as the remainder of the country.

• Each of these factors was objectively known to the defendant at the material time.

[94] Unlike the “reasonable predictability” of the hazard discussed above, s 2A requires an assessment of “likelihood” as to the harm. “Likelihood” is not a threshold, but rather one of the factors that must be weighed in assessing the quantum of risk and the overall practicability of the step. I accept the defence submission that the likelihood of assault with a weapon occurring on any given day in the Ashburton office was relatively low. However, it was more than negligible. The SOSHI database records events that had occurred at the Ashburton office itself, which indicated it was vulnerable to international and organisational trends of client- initiated violence. The defendant had knowledge of this likelihood through its SOSHI database and the Ruffell Report.

[95] The likelihood, weighed together with the severity of the harm, produces a significant quantum of risk. The practicability of practicable step (a), and the

_{efficacy and cost of those means, must be considered in light of this quantum.}

31. Due to the systemic underreporting of incidents noted above at [66], the frequency of these events may be understated.

Section 2A(1)(d): The current state of knowledge about the means available to achieve the result, and about the likely efficacy of each of those means

[96] I must consider knowledge of the means available to protect employees, and the likely efficacy of each of those means. In the context of practicable step (a), this requires consideration of physical restrictions on access to the defendant’s employees by violent clients. The s 2A(1) factors are not a checklist or criteria. However, it follows as a matter of logic that if the prosecution cannot establish any effective means of addressing the risk, known to the defendant at the material time, the alleged step is unlikely to be reasonably practicable.

[97] It is obvious that total seclusion of the defendant’s employees from clients is neither desirable nor viable. The defendant has a statutory obligation to deliver services to clients, and this requires a degree of personal interaction at workplaces such as the Ashburton office.

[98] The prosecution submitted that the primary consequence of installing of a physical barrier was that it would delay a violent attacker, allowing employees time to retreat to safety. Essentially, physical barriers would have created separate “zones” which could not be reached by clients unless access was granted by employees. However, the prosecution experts differed as to the form that the physical barrier and zones should have taken. Three possible mechanisms were advanced: an internal controlled-access barrier, an external controlled-access barrier, and the use of physical barriers at the point of interaction between clients and employees.

[99] In Mr Kahler’s evidence was that it would have been reasonably practicable for:

• a physical barrier to be placed between the reception and the workspace, effectively dividing the office into two zones (an “internal controlled-access barrier”). The workspace, where most employees would have been located, would have remained configured in open plan;

• access to the workspace to be controlled through the use of locking doors in the physical barrier between the reception and the workspace. The doors would ordinarily be locked, and unlocked only by the receptionist;

• the receptionist and a security guard to be the only staff ordinarily situated in front of the barrier;

• the receptionist’s desk to be of a sufficient height, and attached to a wall so that a violent client could not reach the receptionist;

• the receptionist should also have had an emergency exit located behind the desk; and

• the barrier to have been constructed from bulletproof materials. However, as I have not accepted that a lone mission-oriented gunman was a reasonably predictable hazard, I do not consider that the internal controlled-access barrier needed to be bulletproof.

[100] Mr Joseph’s evidence was that it would have been reasonably practicable for:

• locked doors to have been installed at the entrance to the office (an “external controlled-access barrier”), which could be unlocked only by the receptionist or a security guard;

• all clients to have been assessed by a security guard before being granted access into the building; and

• the Ashburton office to have been zoned into separate individual client meeting rooms. The prosecution did not pursue this aspect of Mr Joseph’s evidence, and instead accepted that the Ashburton office workspace could have been configured in open plan.

[101] Mr Kahler and Mr Joseph also provided evidence as to the value of barriers at the point of interaction between clients and case managers. They both discussed the importance of separating clients and employees by ensuring that desks were of a sufficient height, and affixed to walls or partitions. Such barriers would maintain

many of the essential elements of open plan design, but ensure that clients could not reach employees by climbing over or around their desks. In this model, employees would have routes of exit located behind the desks to a staff-only zone, which would be separated by a complete barrier (such as a wall). Employees who did not have client-facing roles could have been situated in this staff-only zone. Collectively, these features could be described as a “zoning model”.

[102] Mr Robinson, the main expert witness for the defence, believed that no physical barrier in any form was required at the Ashburton office prior to 1

September 2014. Mr Robinson’s view was supported by the other defence witnesses, Mr Boyle and Mr Murray Jack, a governance consultant and co-author of the Robinson/Jack Reports.

[103] It is important to note that these physical barriers and zones were advanced by the prosecution as part of a suite of controls to address the hazard of client- initiated violence. These other controls are reflected in the other practicable steps formulated by the prosecutor, listed at Appendix 1. Mr Kahler in particular emphasised that measures such as a “zero tolerance” policy and staff training would have completed the implementation of physical barriers and zoning. A comprehensive approach to security risk management requires that different layers of controls are applied to address different vulnerabilities: various measures will respectively deter, detect, delay, respond to or recover from an attack. This approach is sometimes referred to as the “Swiss Cheese Model”. Security incidents are multi- factorial, and each contributing factor can be represented as a hole in a layer of Swiss cheese. An alignment of holes in every layer — including the “delay” layer — will lead to a security breach occurring. The purpose of a comprehensive security risk management approach is to ensure that this alignment does not take place. The fewer the holes in the Swiss cheese, the less the likelihood that a particular safety incident will occur. Mr Kahler considered that the physical barriers and zoning filled the hole in the “delay” layer, while other practicable steps could respond to other layers (such as deterrence and detection). The underlying theory of this model was not contested by Mr Robinson or any other of the defence witnesses.

[104] At the time of the Ashburton incident, physical controls were in place at a number of government offices including ACC. Barriers and zoning were also used at other service-oriented organisations, such as banks. They were not in place at the Ashburton office.

Controlled-access barriers

[105] For the reasons set out below, I cannot be sure that either the internal or external controlled-access barriers would have been effective in controlling for the hazard of client initiated violence.

[106] The alleged efficacy of internal and external controlled-access barriers is that they would have allowed a security guard or receptionist to assess whether a person constituted a hazard before they entered the building or workspace. Potentially hazardous clients could be screened and denied access if (for example) they had previously been trespassed; were carrying weapons; or were intoxicated or agitated. The security guard or receptionist could then deny access to the office or working area. If a violent client attempted a forced entry (for example, by smashing a glass door with a blunt instrument), the attack would be delayed and the premises evacuated. Mr Kahler also suggested that controlled-access barriers could have a deterrent effect on potentially violent clients.

[107] Mr Robinson disputed this evidence on two grounds. First, he challenged whether controlled-access barriers were effective in counteracting situational or mission-oriented violence. Secondly, he argued that the controlled-access barriers would have the effect of displacing or creating alternative forms of violence.

[108] In challenging the efficacy of controlled-access barriers, Mr Robinson made reference to the situational nature of client-initiated violence. Because situational violence occurs in response to perceived denial of entitlements or service, it often arises at the point of interaction between the client and a particular employee. In many instances, therefore, a guard or receptionist maintaining access through a controlled barrier will not detect anything unusual about a person’s behaviour as they enter the building or the workspace. Potentially violent clients would have been

particularly difficult to detect given the high volume of the defendant’s service activities, where the vast majority of clients would have presented no hazard and accordingly would have gained access after a cursory query from the security guard or receptionist. Mr Robinson observed that despite his vast experience as a Police officer and security consultant, he did not believe that even he would be able to detect those few clients with the potential to act violently.

[109] Furthermore, Mr Robinson said an internal or external barrier would also be ineffective in addressing the hazard posed by those clients who were mission- oriented. Mission-oriented attacks are often focussed on particular employees who the client perceives as being responsible for their circumstances, and may involve a client returning to the office after already having been denied entitlements. In many of these instances, potentially dangerous weapons could be concealed and only used once the client had gained access to the particular employee they intend to target.

[110] These problems identified by Mr Robinson narrow the efficacy of an internal or external barrier. However, they do not entirely eliminate it. Mr Robinson accepted that there will be times where an attacker will present as violent at the point of entry into the office or workspace. He conceded that in such instances, a controlled-access barrier would have some utility and the attacker could be denied entry, thus preventing or delaying their access to employees. Although I am satisfied that a controlled-access barrier would have efficacy in some instances, I acknowledge that these instances would be rare.

[111] The second ground on which Mr Robinson challenged the prosecution evidence was the issue of collateral. Mr Robinson framed the challenge of security as a “wicked problem”: that is, a problem where purported solutions may create alternative security problems elsewhere.

[112] In particular, Mr Robinson suggested that situational violence could be displaced from the point of interaction with case managers, to persons at the point of the barrier. Because controlled-access barriers could be viewed by clients as another form of impediment, frustration, or denial of service, clients could become agitated or aggressive. Mr Robinson believed that internal or external controlled-access

barriers would inevitably lead to “false positives”, instances where non-violent clients are wrongly turned away because of false suspicions. Such instances could give rise to a sense of grievance at being denied access to services and entitlements that are essential to many of the defendant’s clients. Instead of ameliorating client- initiated violence, controlled-access barriers could contribute towards its cause. Client-initiated violence directed at case managers could be displaced to the nearest person in the event that a client is denied access to the workspace. In the instance of an external barrier the target would be any security guard (or possibly client) situated in front of the barrier. In the case of an internal barrier, the target would be a receptionist (and possibly security guard) stationed in the reception area, as well as any clients seated in the area before being admitted to the workspace. The effect of controlled-access barriers in some instances could have been to place the security guard, receptionist or other clients at increased risk of violence.

[113] Furthermore, Mr Robinson expressed the opinion that internal or external barriers could make clients feel uncomfortable and impede opportunities for de- escalation. Mr Robinson drew on the theory of Criminal Prevention through Environmental Design (CPTED). CPTED literature — which was also cited by Mr Kahler — emphasises the importance of open sightlines and easy routes of access as means to de-escalate violence.32 Mr Robinson suggested that supervisors located in the workspace would be less likely to notice incidents of violence occurring on the other side of the controlled-access barrier. This could convey to clients the

impression that they are not being observed, and also impede the ability of supervisors to intervene and de-escalate low-level incidents of violence. Mr Robinson provided examples from his own observations of de-escalation where a supervisor or security guard quickly moved to defuse a low-level incident, or provide

_{support to a case manager.}

[114] Finally, Mr Robinson noted that CPTED literature affirms the efficacy of aesthetically pleasing and welcoming architecture in creating a positive environment for clients. Improving client perceptions of an organisation may reduce incidents of

_{situational violence. Controlled-access barriers could suggest that clients were not}

32 See for example TD Crowe and DL Zahm “Crime Prevention Through Environmental Design”

Land Development (Washington DC, Fall 1994) at 22.

welcome in the office, or that the defendant was inherently suspicious of its clients. Although Mr Robinson acknowledged that CPTED literature also affirmed the efficacy of zoning and territorial divides, he expressed the view that this would be better achieved through visual signals rather than controlled-access barriers.

[115] Overall, Mr Robinson’s evidence narrowed the scope of the alleged efficacy of external and internal controlled-access barriers to a small number of potential incidents, and identified a number of collateral detriments. The effect of this evidence is to raise sufficient doubt as to whether a controlled-access barrier, either internally or externally located, was a known effective means of ensuring the safety of employees. While I accept the underlying philosophy of the mechanism, it is not clear that a controlled-access barrier would achieve the intended result in a manner proportionate to its deleterious effects.

[116] This is not to say that external or internal controlled-access barriers will never be appropriate. The findings in this judgment relate only to what was known in relation to the specific circumstances of the Ashburton office. Other offices at other times may have a heightened or different form of risk — for example, following a specific threat. In such cases, it is possible that the collateral proportionality calculus may fall in favour of controlled-access barriers.

Zoning model

[117] On the basis of the evidence before me, controlled-access barriers were not the only form of physical barrier available to the defendant. The defendant could have implemented a zoning model, which would have included a physical barrier at the point of interaction between clients and defendants. Although this model was not the primary focus of the prosecution, it clearly fits within the scope of the practicable step as drafted.

[118] A zoning model would have divided the Ashburton office into three zones. In Zone 1, clients would have been able to freely enter the office. They could have interacted with case managers who would be located in Zone 2. The restriction on access between clients in Zone 1 and employees in Zone 2 would have been in the

form of barriers such as desks, which would have been affixed to walls or other partitions. This would have ensured that clients could not easily reach employees or enter Zone 2 by moving around or over the desks. From Zone 2, employees would have had easily accessible routes of retreat to Zone 3. Zone 3 would have been a dedicated staff only area, separated from Zone 2 by a solid wall. Staff amenities and employees performing non-client facing tasks would have been located in Zone 3.

[119] In the Ashburton office, clients could access all areas of the premises, including the staff lunchroom, meeting rooms and toilet facilities. Furthermore, the desks at the office were not positioned to form a physical barrier between staff and clients. Clients could physically access staff by reaching around or over the desks. The desks in the open plan office were not connected to barriers on either side. Although the reception desk was higher than the workspace desks — at approximately chest-height — there were no barriers on either side of the desk. Egress points were not positioned in a way such that employees could access a secure zone without encountering clients. There was therefore potential for employees to be cornered or trapped at their workspaces.

[120] Mr Joseph said these measures were essential in delaying an attack by a client. An attacker would encounter a physical barrier before they could reach an employee. Mr Joseph believed that, in particular, the receptionist’s desk should have been raised to ensure that an attacker could not reach over the desk. The employee could then utilise the delay to escape through a secure route of egress, from Zone 2 to Zone 3. The route of egress would need to be easily accessed without passing through an area accessible to clients, so that a violent client could not position him or herself between the employee and the exit. I note that the potential for this entrapment was identified in the 2012 Ruffell Report, but did not appear to have been addressed at Ashburton prior to 1 September 2014.

[121] Although Mr Kahler did not initially advocate the use of a zoning model, when it was presented to him in examination-in-chief he accepted that it would be an improvement on the design of the Ashburton office prior to 1 September 2014. Mr Kahler believed that a barrier between Zone 1 and Zone 2 to create distance and delay would allow employees to retreat from client-initiated violence, particularly

where that violence was concealed until the point of interaction with employees. Furthermore, Mr Kahler believed that the implementation of Zone 3 would have protected employees who were not actively engaging with clients.

[122] Although Mr Robinson believed that the Ashburton office was not required to control for the hazard of clients armed with weapons other than firearms, he believed that had he accepted the predictability of the hazard of client-initiated violence (involving weapons other than firearms), the zoning model would have been an effective means of addressing it. The barrier would have allowed the employee to retreat to a safe and secure area via a well-defined route of egress. In Mr Robinson’s view, the zoning model would have been more effective than physically controlled access in instances of both manual assault, and assault with a weapon. It would have provided protection against weapons or aggressive intent that manifested only once the client had already entered the workspace. Furthermore, it would not have resulted in collateral problems such as displacement and false positives, and would have maintained many of the principles of CPTED. He did, however, note that barriers should not be unduly intimidating or make clients feel unwelcome. Mr Boyle noted that jumpwire was an example of an unwelcoming barrier.

[123] I consider that the zoning model would have been an effective step in minimising the harm posed by the identified hazard. All experts agreed that the design could be effective. Furthermore, as aspects of the design were utilised by other service organisations, I find that it was an option that was objectively known to the defendant to be effective in addressing the hazard of client-initiated violence.

[124] I find it would not be helpful or appropriate for the Court to specify the appropriate design, such as materials and dimensions, with total precision. It is enough to specify that the design should have:

• Ensured some form of physical barrier to delay a client attempting to manually assault an employee, or assault an employee with a weapon other than a firearm.

• Been effective in delaying the attacker both from the side, and over, the employee’s desk. The barrier need only delay an assailant – it did not need to be full-height (such as jumpwire, Perspex or glass).

• Allowed the employee to quickly reach a route of egress without having to move toward the client (an employee must not be trapped in the corner of the workspace).

• Ensured a route of egress that led the employee to a secure zone to which clients did not have access.

• Ensured these measures were also in place for the receptionist.

• Ensured that sightlines were maintained so that most client interactions were visible to security and other employees (in line with the CPTED principles discussed above).

[125] This finding is made in the context of the defendant’s guilty plea in respect of other practicable steps. In particular, I note that the defendant has acknowledged that it failed to have in place adequate training for employees and contractors to respond to an emergency response incident. Adequate training would have improved the ability of employees and contractors — including security guards — to de-escalate incidents and maintain a degree of control over the working area.

[126] I do not suggest that these principles should have applied to all interactions between clients and Ashburton employees. The hazard I have referred to throughout this judgment relates primarily to the interactions between clients and case managers where clients are applying for certain entitlements. There may be occasions where interactions at the defendant’s offices need to take place in private or seminar formats. As I have not been provided with evidence of the potential harm the hazard could cause to employees in these circumstances, it is inappropriate that I address what architectural design (if any) would have been appropriate.

Section 2A(1)(e): the availability and cost of the means

[127] To find that a step is not reasonably practicable because it is prohibitive in terms of cost, the cost must be “grossly disproportionate” to the risk of harm generated by the hazard.33 I note that in some cases, courts have effectively found

that no cost can be grossly disproportionate to a high risk of death.34

[128] Since the Ashburton incident, the defendant has estimated the property costs of the zoning model as ranging site-to-site from $50,000 for a small site utilising an existing build, to $180,000 for a medium site requiring a new build. Although these costs were assessed after the Ashburton incident took place, I am satisfied that they would have been substantially similar prior to the incident. I do not consider this cost to be grossly disproportionate to the risk posed by violent clients. The potential harm was severe. The defendant’s own security data demonstrated the hazard of clients using weapons to carry out violent acts. Accordingly there was a significant quantum of risk. The cost must be seen in the context of a $400 million annual operating budget. I am satisfied that the associated costs are within the realms of reasonable practicability.

[129] As this judgment has focussed on the practicable step in respect of the Ashburton office, I have considered the proportionality of the cost in relation to that site alone. However, even if I were to consider the cost in the context of all of the defendant’s similar places of work, my conclusion as to cost would remain the same. The defendant has estimated that the nationwide cost would be between $13.1 million and $27.3 million. Given the severity of the potential harm, the potential risk and the defendant’s large operating budget, I am satisfied that the cost would not be disproportionate to the potential harm.

Causation

[130] It is not necessary to establish a causative link between failure to take an alleged practicable step and any harm suffered.35 Causation is, however, relevant to

33 _{Edwards, above n 22; Marshall v Gotham, above n 13.}

34 _{See for example Martin Simmons, above n 22, at [31].}

35 Waimea (DC), above n 3, at [36].

sentencing. Section 51A of the HSEA 1992 requires the sentencing court to consider the “degree of harm, if any, that has occurred” as a result of the breach of the duty.

[131] I am not persuaded beyond reasonable doubt that the zoning model would have minimised the particular harm wrought by Mr Tully. Mr Tully’s actions were outside the scope of what was reasonably predictable in Ashburton at the time. Any further analysis would amount to conjecture. It is impossible to be sure what Mr Tully would he have done had the zoning model been in place. For example, would he have shot the security guard? Would any delay have been sufficient for the receptionist and other case managers to have retreated to the safe zone? Would Mr Tully have been more discrete in carrying his shotgun? Would Mr Tully’s intended targets happened to have been stationed in the workspace, or in the safe zone? It would be speculative and indeed unhelpful for me to attempt to answer these questions on the limited evidence before me.

Conclusion

[132] The hazard of client-initiated violence at the Ashburton office prior to 1

September 2014 was reasonably predictable. It was reasonably predictable that the hazard could manifest by a client being assaultive, or assaultive with a weapon other than a firearm.

[133] I am sure that physical restrictions on client access to the staff working area, for example in the form of the zoning model comprising the elements listed at paragraph [124], were shown to be a reasonably practicable step in response to the hazard.

Result

[134] I find the disputed practicable step proven beyond reasonable doubt.

[135] Counsel are to confer and provide the Court with a memorandum on agreed timetabling of submissions on sentencing.

[136] Having regard to the agreed timetabling, counsel are to confer with the

Registrar in order to establish a suitable date for sentencing to take place.

Jan-Marie Doogue

Chief District Court Judge

Appendix 1: Alleged practicable steps

(c) Ensuring that there was no physically unrestricted access by clients to the staff working area;

(d) Ensuring employees and contractors were adequately trained to respond to an emergency response incident;

(e) Adopted and effectively embedded a “zero tolerance policy” well prior to the incident by:

(i) publishing a “Zero Tolerance” policy;

(ii) embedding a “Zero Tolerance” policy in systems, standards and procedures and, in turn, in its staff; and

(iii) strategising to create a positive security culture and implementing those strategies.

(f) Implementing a client risk profiling process;

(g) Implementing a client management plan tailored to the risk assessment of that client;

(h) Implementing effective incident investigation and incident data analysis, including by:

(i) Analysing the incident basis of security incidents on an annual basis and transferring the learnings to MSD;

(ii) Setting key performance indicators with respect to security incidents and reviewing these monthly/quarterly;

(iii) Engaging periodically with selected frontline staff from selected locations to evaluate the effectiveness of security/related systems;

(iv) Instituting a comprehensive investigation process and analysis model applied to critical security/related incidents; and

(v) Developing a security management plan or equivalent document at the highest level of MSD with clearly stated context, purpose, defined accountabilities, plan owner, internal review and external audit timeframes etc;

(vi) Completing a security audit using established risk management models and standards to aid in the establishment of the security management plan.