Most organisations have an emergency response plan. Far fewer know whether it would work. A fire, chemical spill, flood, cyber attack or serious injury is the wrong moment to find out that the contact list is out of date or that nobody knows who decides to evacuate.
This guide covers what an effective emergency response plan contains and how to test it with a tabletop exercise.
Why it matters
- Safety: the first minutes of an emergency decide how serious the outcome is.
- Standards: ISO 45001 and ISO 14001 both require organisations to prepare for and respond to potential emergency situations, and to test their planned response periodically where practicable. ISO 22301 requires an exercise programme for business continuity.
- Clients and regulators: oil and gas operators, ports and large clients routinely ask contractors and suppliers for evidence of emergency planning and drills.
What an effective plan contains
- Credible scenarios based on your risk assessment: fire, chemical release, medical emergency, severe weather and flooding, loss of power or IT, security threats, and site-specific events.
- Roles, not just names: who leads on site, who calls emergency services, who accounts for people, who speaks to families, clients and the media. Each role has a deputy.
- Clear first actions for each scenario, on one page, usable under stress.
- Up-to-date contacts: emergency services, the nearest hospital, key staff, critical suppliers, clients and the relevant authorities.
- Resources and their locations: assembly points, alarms, fire equipment, first aid, spill kits and shut-off points.
- The link to recovery: when the emergency is over, how the business continuity plan takes over to restore operations.
Testing the plan: the tabletop exercise
A tabletop exercise is a facilitated discussion in which the people who would respond work through a realistic scenario, step by step, without leaving the room. It tests decisions, communication and information flow at low cost and without disrupting operations.
How to run one
- Set objectives. Decide what you want to test, such as escalation, communication with clients or decision-making when information is incomplete.
- Write a scenario relevant to your site, with injects: new pieces of information released during the exercise, such as “a worker is missing” or “a journalist is calling”.
- Invite the real responders, including deputies, and keep the group small enough for everyone to contribute.
- Facilitate, don’t lecture. Ask what each person would do, who they would call and what information they need. Keep a timeline.
- Debrief immediately: what worked, what did not and what was unclear.
- Turn the findings into actions with owners and dates, and update the plan.
Tabletop exercises work well alongside physical drills, such as fire evacuations and spill response, which test the practical side.
What exercises usually reveal
- Contact details that are wrong or missing, especially after hours.
- Uncertainty about who has authority to stop work, evacuate or call in external help.
- No agreed process for communicating with families, clients and the media.
- Plans that assume key people are always on site.
- No clear hand-over from emergency response to business recovery.
How often to test
Test at least annually, and after any significant change: a new site, a major incident, a change in key personnel or new client requirements. Vary the scenarios so that different parts of the plan are tested over time.
Next step
An independent facilitator can design a realistic scenario for your site, run the exercise, and give you a short report with prioritised improvements to your emergency and business continuity arrangements.
Want an independent view of where you stand?
Our senior team in Kuala Lumpur can review your current arrangements and give you a clear, prioritised plan.
This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.
