1. UVU had solid policies and committees on the books—but they didn’t always use them.
The Major Events Assessment Committee kicked in, the emergency plans existed, the police procedures were there. The gap was turning all that paperwork into consistent, documented action when a high-profile speaker showed up.
2. TPUSA insisted on the outdoor Fountain Courtyard—even after UVU raised safety and control concerns.
University staff flagged the problems with an open, harder-to-secure space. TPUSA preferred it anyway. That decision limited the university’s ability to manage the crowd and the risk.
3. TPUSA kept control of ticketing and never gave UVU reliable numbers.
They used their own system instead of the university’s. Result: UVU couldn’t get solid, real-time data on how many people were actually coming. Hard to plan security when you don’t know the size of the crowd.
4. The risk questionnaire from TPUSA downplayed the whole thing.
Projected only about 600 attendees, called it mostly student-focused, and said there were no real safety or security concerns—and no need for emergency medical services. That understatement shaped everything that followed.
5. Security coordination started late and stayed thin.
UVU’s police chief had to chase TPUSA’s security people for contact info. The formal pre-event briefing and joint walk-through that should have happened never did. Critical opportunity missed.
6. TPUSA’s protection detail focused narrowly—and didn’t push for a full elevated-position plan.
Their main documented concern was one walkway above the canopy. Broader rooftop and line-of-sight issues didn’t get the same attention. The report calls the lack of a requested on-site briefing “particularly significant.”
7. After the shooting, incident command and emergency communications got messy.
No immediate campus-wide alert from the incident commander. Later messages were inconsistent, terminology was confusing (“secure-in-place”), and situational awareness suffered. Prior tabletop exercises had already flagged some of these same problems.
8. Security technology existed, but it wasn’t fully integrated into real-time operations.
Cameras, access control, alert systems—they were there. Getting them working together smoothly under pressure is a different story.
9. TPUSA and its key security people largely refused to cooperate with the independent review.
Brian Harpole, Dan Flood, Maycee Crofts, and TPUSA headquarters all got outreach—including certified letters. No interviews. The report notes that Harpole’s later public statements about who chose the venue conflicted with the emails and meeting records.
10. UVU did a lot right after the incident and is already working on fixes—but staffing, training, and organizational placement of campus safety need a closer look.
Post-event support for students was strong. Support for first responders less so. The police department’s size, training plan, and where the chief sits in the org chart don’t fully match a large university’s risk profile. Utah is building better statewide intelligence sharing—UVU should lean into that.
uvu.edu/externalreview/docs/…