Emergency action plan template

By Brightmine

What is an emergency action plan?

An emergency action plan (EAP) lays out the emergency procedures an organisation will take in case of an emergency. It identifies the roles and responsibilities of those involved in emergency response and provides important guidance. The EAP also provides contact information and links to resources. HR should make it available to all employees.

Emergency action plan template

This is an example document and should be adapted to suit your circumstances.

Introduction

The organisation has developed this emergency action plan (EAP) for use in preparing for, and responding to, events with the potential to lead to serious disruption of parts, or all, of its business. The plan covers crisis management and disaster recovery in the event of theft, fire, flooding, fraud, terrorism, vandalism, or IT and utilities failure.

Emergency action planning is not a one-off exercise. This plan emphasises the importance of regular testing and revision, and training for managers and employees in its provisions. Contingency planning is more than a data processing issue, and covers the protection of IT, physical, intellectual and human assets. All of these functions in the organisation must be involved in preparing for, and responding to, emergencies and maintaining the effectiveness of the plan.

Objectives

The purpose of this plan is to:

• Enable the organisation to re-establish normal operations in as short a period as possible following an emergency
• Establish a crisis management team (including emergency responders), to coordinate the recovery
• Ensure that staff are aware of the plan and are supported in the aftermath of any event

Planning for a disaster

Emergency action planning starts before any incident and involves the establishment of an organisation-level crisis management team. This team includes representatives from the HR, security and facilities functions. A coordinator will lead the crisis management team with the support of site-level emergency responders.

The crisis management team is responsible for the overall coordination and delivery of the plan. and its specific functions in the event of a disaster include:

• Reporting progress to senior management
• Authorising expenditure on recovery up to [state maximum amount]
• Implementing an IT recovery plan
• Liaising with the media
• Securing personnel records
• Liaising with insurers
• Securing buildings, property, equipment and data
• Liaising with [clients/customers]

The following individuals are members of the crisis management team: [list individual members].

The EAP describes the functions and personnel of the organisation considered to be “essential” and “non-essential”. The functions considered to be essential are: [list critical functions]. The personnel considered to be essential are: [list critical personnel].

[Units/departments] should seek to ensure that essential tasks are not carried out by one or two people in the same critical area of the business. Cross-training is essential in these key areas to avoid the loss of an employee having a disproportionate effect on the organisation’s ability to maintain its critical functions.

In planning for an emergency, the following steps will also be taken:

[List the essential steps the organisation will take in case of emergency. Examples include:

• All [units/departments] will draw up an inventory of equipment, procedures and activities.
• All [units/departments] will identify employees with first-aid or other medical training.
• The HR department will maintain up-to-date contact details for all employees, including temporary and contract staff.
• All [units/departments] will store hard copies of valuable documents in reinforced cabinets or boxes.
• All [units/departments] will follow normal organisational procedures on backing up and storing vital data.
• [Name of function] will ensure that the insurance provisions covering business disruption are sufficient and up to date.]

An emergency pack exists and is stored off-site at [location]. Its contents include:

[Insert list of contents, which may include:

• A hard copy of the EAP
• Up-to-date contact details for all employees
• Contact details for suppliers and [clients/customers]
• A physical plan of the work site with escape routes]

Disaster categorisation

We cannot prescribe an action for every type of major disruption. Examples of disruption include the loss of staff, the breakdown of the telephone network, an IT system failure or a power outage in an office. This plan provides a framework and structure for organisation-level action, including the establishment of an emergency response team and nominated individuals in each [unit/department].

The type and level of response to a disaster will depend on the number of people affected and the scale and duration of the disruption. A scale of one to six will be used to categorise the disaster and the response required:

Level one

An inconvenient incident that will be dealt with internally, possibly by allocating staff to alternative work within the building.

Level two

A more serious incident involving [ ] or fewer employees. Employees may be sent home if they’re unable to work in an alternative location within the building.

Level three

An incident involving [ ] or more employees, affecting either a significant part or the whole of a building.

We will maintain telephone communications at switchboard level. The remaining staff will be sent home with instructions to await advice on a [time/day] that they can return to work. If a building is abandoned, nominated persons will secure it and inform other locations that telephone calls are being diverted.

Level four

A more serious incident involving [ ] or more employees and the closure of at least one location.

Managers and the crisis management team will decide work priorities and alternative working [locations/patterns of hours] for essential staff. Non-essential staff will be sent home with instructions to await advice on a [time/day] that they can return to work.

Level five

An incident involving the closure of buildings affecting [ ] or more employees.

Managers and the crisis management team will allocate priority work to essential staff in a recovery centre (for example, if sites are closed for more than [period of time]), using hot-desking, shiftworking, homeworking and teleconferencing. The crisis management team will consider using meeting rooms in local hotels and conference centres for essential staff.

Non-essential staff will remain at home and maintain contact with the organisation through a range of communication channels, including:

• A dedicated part of the organisation’s intranet that can be accessed externally
• Messages on dedicated telephone lines
• Contact with staff at sites that remain open

Level six

An incident that severely disrupts the business, resulting in the closure of one or more locations for at least [period of time].

The crisis management team will arrange for all critical data and other [equipment/stock] to be removed from the affected site and relocated. IT services will set up in alternative offices.

Staff and customers will be kept informed of developments, with regular updates on the expected date of full recovery. Alternative premises will be secured and equipped if the [site is/sites are] expected to remain out of commission for more than one month.

Emergency response during an incident

Elements of a response during an incident include:

• Alerting emergency services and utility companies [give details of emergency services’/utility companies’ telephone numbers]
• Evacuating premises
• Providing first aid
• Identifying casualties and missing employees
• Considering the health and safety issues of all staff
• Communicating with staff on the next steps (eg sending them home; providing transport if necessary; and advising staff not to contact the incident site during the initial 48 hours, except in the case of an emergency)
• Limiting property damage]
• Informing insurers
• Redirecting communications and informing other work sites
• Securing premises

Response following an incident

The response after an incident has taken place will include the following:

• The crisis management team will assess the impact on the organisation in the form of a [damage assessment/business impact analysis].
• The crisis management team will prioritise the recovery of [units/departments] according to how critical they are to the business. [Units/departments] assessed as critical will be reestablished on day one of the incident; those with medium critical status will be reestablished by day five; and those with low critical status by day 10.
• The crisis management team will decide on the next steps in conjunction with senior managers. Steps to consider include: recovering the use of a site after minimal closure; relocating to another of the organisation’s premises; or seeking alternative premises such as a hotel conference room or business recovery centre.
• Secure, password-protected pages that can be accessed externally will be set up on the intranet to keep employees located at home informed of developments.
• A dedicated texting number will be made available for employees to leave an “I’m OK” message during a major disaster.
• Communications will be maintained with [clients/customers] using websites and telephone messaging.
• The recovery of [data/essential physical assets] from the affected site will be arranged, in line with the IT recovery plan.
• The crisis management team will make arrangements to enable staff to collect vital personal affects (eg cars and house keys) from the affected site as soon as it is safe for them to do so.
• The crisis management team, in conjunction with the HR department and occupational health, will draw up plans for supporting staff after the disaster, including counselling where appropriate.

Training

[Name of function] is responsible for annual training covering the plan. Training will also take place after every revision to the plan for those who have particular responsibilities under it.

The crisis management team and all employees must complete training to understand their roles in the business recovery process.

The [crisis management team/HR department] will maintain records of training, including attendees and an overview of the training content.

Testing and review

[Insert department] will review this plan and update it at least annually. [Insert department] will also review and update it following:

• Operational, legal or environmental changes that may have an impact on any aspect of emergency action planning
• An exercise or rehearsal of any aspect of the plan that reveals failures or deficiencies
• An actual disaster, if this reveals shortcomings

Reviews of the plan will take into account the provisions of other relevant organisational policies, eg those on risk management, facilities, security and data protection.

A disaster drill to test the plan will take place at least annually, and a [report/evaluation] of this exercise will be compiled by the crisis management team, with copies provided to senior management and [list of functions].