[ISO 45001 Series] Planning: Emergency Preparedness and Response

Introduction

In my article “[ISO 45001 Series] Planning: Overview of Controls and Planning Risk Controls,” I proposed a method for planning controls for routine risks that remain unacceptable.

Even after risk has been reduced to an acceptable level, remember that the original decision about acceptability considered both the severity of harm and the likelihood of occurrence.

In other words, acceptable risks can still include hazards that are very unlikely to occur but could cause casualties on a large scale if they do.

These hazards may be extremely unlikely, but neither an organization nor its environment remains unchanged forever. The organization therefore still needs to plan what it will do if such a hazard does occur. That is the purpose of emergency preparedness and response measures.

ISO 45001 Requirements for Emergency Preparedness and Response

ISO 45001 addresses emergency preparedness and response in Clause 8.2 of Chapter 8, Operation, separately from Clause 8.1, Operational Planning and Control. I have summarized the main requirements below.

For identified potential emergency situations—whether caused by natural, technological, or human factors, and whether they occur during or outside normal working hours—ISO 45001 requires the organization to establish, implement, and maintain the processes needed to respond.

Response planning must consider the needs of interested parties and include communication with all workers, contractors, visitors, emergency response services, and others as appropriate. The organization must provide relevant training, periodically test its response capability, evaluate response performance, revise plans when necessary, and maintain and retain relevant documented information.

Wait—is that really enough guidance for a major emergency?

Well, of course it is not enough XD.

A Practical Approach Recommended in This Article

Meaning and Function of Emergency Preparedness and Response Measures

After hazards are identified, risks assessed, and risk-reduction measures planned, residual risk remains even when risk has been reduced to an acceptable level. Because risk reflects both severity and likelihood, some hazards are classified as acceptable only because they are unlikely, even though their consequences could be severe. Such risks still require effective controls: immediate action plans or measures carried out by frontline workers or designated teams. This is emergency response.

Characteristics of Emergency Preparedness and Response Measures

During an emergency, an organization has little time to decide who is responsible for what, how work should be performed, or how external support can be obtained. Failure to take effective control measures quickly can lead to serious consequences. Organizations should therefore prepare emergency response plans and conduct training in advance so that people can respond effectively and reduce losses.

Emergency preparedness and response should continue to use the earlier hazard-identification and risk-assessment results as an important foundation, so there is no need to mechanically repeat the entire assessment at this step. The organization must still identify potential emergency situations and re-examine the relevant scenarios, risks, and response plans whenever the work environment, legislation, actual incidents, or drill results change.

Taiwan's Occupational Safety and Health Management System (TOSHMS) and ISO 45001 take broadly similar approaches to emergency preparedness and response. I therefore use the TOSHMS Technical Guidelines for Emergency Response Measures as the framework for this section. More specifically, I combine the Ministry of Labor's 2015 guidance_[1] with ISO 45001 and the control systems developed elsewhere in this series.

This section therefore covers only four parts: selecting the people who will prepare the plan and assessing resources; developing the emergency response plan; emergency response training and drills; and reviewing and revising the emergency response plan. Each part is explained below.

Selecting Planning Members and Assessing Resources

Before preparing an emergency response plan, the organization must appoint a group of people with different technical backgrounds to develop a suitable plan.

Because an emergency response plan involves the use of personnel and financial resources, top management is best placed to oversee it. ISO 45001 also requires top management to ensure that the resources needed for the OH&S management system are available. I therefore recommend that a member of the organization's highest leadership level lead the emergency-response planning team.

The size of the emergency response team may reflect the organization's scale and operating characteristics, but it should include people from different units as well as OH&S personnel and managers. The planning-team leader should assign work—such as collecting information or drafting notification procedures—according to each person's expertise or position.

Before preparing the plan, the team must assess the organization's existing response capabilities and resources. Capabilities include workers' professional skills, experience, and training; resources include devices, equipment, supplies, and logistics support.

The following checklist template is adapted from the Technical Guidelines for Emergency Response Measures. Organizations may add items that fit their circumstances and use the checklist to determine whether their emergency response capabilities and resources are sufficient.

Emergency response plans are generally developed for specific hazards. The “Emergency-Response Capability and Resource Assessment Checklist” above can be linked to the hazard-identification checklist in “[ISO 45001 Series] Planning: Overview of Planning and Hazard Identification” by entering the corresponding hazard number. If one response plan is intended to address several hazards, complete a separate capability and resource assessment checklist for each hazard.

A “No” response indicates a possible gap in the organization's emergency preparedness. The assessor should describe the current condition and discuss improvement measures with the emergency-response planning team.

Developing the Emergency Response Plan

If hazard identification and risk assessment identify a potential emergency within the residual risk, the organization must classify that emergency and prepare an emergency response plan. The table below summarizes the plan content suggested by the guidance.

When planning, the emergency-response planning team should consider every reasonably possible way the emergency could unfold and establish an action plan for each scenario.

In my view, an emergency response plan can broadly be divided into two questions: “What needs to be done?” and “Who is responsible?”

What Needs to Be Done

In the guidance, the answer to “what needs to be done” is the action plan for each situation. It is impossible to start planning only after an incident occurs, so the team must prepare action plans for all relevant scenarios before an emergency happens.

For each identified emergency, type of harm, and potential consequence, I recommend first grading the possible scenarios and then planning action at each level.

The guidance provides the following classification principles and corresponding measures:

Level 1: A small disaster confined within the organization, affecting only one area and controllable using the organization's own response capability.

Level 2: A major disaster within the organization that will not spread beyond its boundaries but requires the organization's response team and may also require external support.

Level 3: A disaster that begins within the organization but spreads outside it, generally threatening external people or property and requiring external support.

Although a disaster may be assigned one of these levels, conditions can change at any time. Every response must reflect the actual scene rather than rigidly following the original classification. As the affected area or severity increases, the response level may need to be escalated.

After grading the potential consequences, the planning team can use information such as hazardous-chemical consequence analyses, dispersion models, and external conditions together with a site map to divide the controlled area into a hot zone, warm zone, and cold zone, with different action plans for each.

Once the potential scenarios have been identified, broadly graded, and mapped into control zones, the team can prepare action plans for each level and zone. The guidance recommends that these plans cover first aid, incident response, and personal protection.

The first-aid plan should cover general first aid as well as special treatment for toxic effects caused by particular substances. It should specify emergency medical and first-aid facilities and list available external medical support—such as ambulances and clinics—including names, telephone numbers, addresses, available services, and travel times.

Incident-response plans may cover matters such as leaks, fires, and the dismantling of buildings or machinery. Different emergencies require different action plans.

Personal protection should cover not only people at the incident scene but especially emergency responders. The level of protective equipment should match the characteristics of hazardous substances and the intensity of the energy involved.

Who Is Responsible

For the question of who is responsible, I recommend that the planning team first divide workers connected with the emergency into those who do not directly participate in response operations and those who do.

People who do not directly participate must be evacuated to a safe place as quickly as possible so they are not affected by an expanding disaster or become an obstacle to response operations. The planning team therefore needs evacuation measures for this group.

ISO 45001 requires emergency planning to consider interested-party needs and communicate with workers, contractors, visitors, emergency response services, and others as appropriate. Contractors and visitors must therefore be included among those not directly participating in response operations. If an incident could affect neighboring facilities, villages, or communities, the response team must also use appropriate systems to notify affected people to evacuate.

The incident commander should decide whether evacuation is necessary based on conditions at the scene; not every incident requires evacuation.

The Technical Guidelines for Emergency Response Measures call for at least two evacuation routes planned in advance so the incident commander can select a route according to actual conditions. Taiwan's Regulations for Occupational Safety and Health Installations also contain related requirements. Article 34, for example, requires emergency exits and similar facilities to remain usable at all times. In addition to planning routes, the organization must therefore keep emergency exits unobstructed.

The organization may select assembly points on or off site so people not directly involved in response can evacuate quickly. Alternative routes and assembly points should not be too close together and preferably should be in opposite directions. Multiple options are better. At an assembly point, conduct a headcount and report the result to confirm that everyone has left the affected area safely. Because visitor and contractor numbers are harder to track, their entry and exit should be registered in normal operations so the number of people on site can be confirmed.

Because an emergency response team must carry out response operations when an incident occurs, the planning team needs to define the team's composition, authorities, and responsibilities in advance.

Based on the guidance, the table below summarizes emergency-response units and their responsibilities during an incident.

When an incident occurs, an incident commander must manage the event, including selecting action plans and directing coordination among teams. For a complex event, an assistant commander or planning team can support the commander in developing emergency actions and response tactics.

In addition to the incident commander, the command team includes a safety officer who verifies responder safety, a liaison officer who coordinates with other response teams, and an information officer who serves as the media contact and releases accurate incident information.

The operations team supervises personnel carrying out the action plans and response tactics selected by the command and planning teams, completes assignments from the commander, and reports incident conditions and resource use back to command.

The logistics team inventories the equipment and resources needed to execute action plans and tactics, ensures that resources are sufficient, and provides them when needed. This includes resources required to maintain organizational operations, equipment and energy supplies needed for assignments, and resources for repairing equipment after the incident.

The finance team records all incident expenditures and direct or indirect losses and, when necessary, arranges funding so that action plans can be completed.

During an incident, the operations team works on the front line. The command, planning, logistics, and other teams need a safe location from which they can direct the overall response and control the emergency. This is the emergency operations center.

An emergency operations center is a predesignated location for policy, related decisions, and allocation of resources within the area of responsibility during an emergency. According to the guidance, it should not be too close to the incident area, where it could be affected by the disaster, and it should be possible to relocate quickly to another assembly point if necessary.

Location selection should therefore consider structural safety, access to external transportation, and the ease of requesting outside support. Internal and external response information and relevant equipment should be readily available in the center, together with telephones for external communication, emergency power, and other essentials.

The Ministry of Labor's Technical Guidelines for Emergency Response Measures recommend that the emergency operations center contain: (1) the emergency response plan, emergency response procedures, and Safety Data Sheets (the original guidance uses “Material Safety Data Sheets”); (2) process, utility, and fire-protection piping and instrumentation diagrams (P&IDs), plus emergency handling information; (3) fire-protection equipment layouts and maps of nearby areas; (4) telephone numbers, including after-hours numbers, addresses, and relevant information for internal and external responders, organizations, communities, and specialist units; (5) internal and external communication equipment, including telephones, radios, hotlines, and fax machines; (6) emergency lighting; (7) communication-record documents and equipment, such as log forms and recorders; (8) lists of response equipment available from internal and external support units; (9) personal protective equipment and first-aid equipment; and (10) food, drinking water, accommodation, and other provisions needed during the emergency.

Emergency Response Training and Drills

Emergency response training and drills can improve personnel capability, test whether the plan is suitable, and reveal deficiencies. Public training and drills may also strengthen public confidence in and recognition of the organization's efforts to prevent harm.

Because ISO 45001 requires plans to consider interested-party needs and communication with workers, contractors, visitors, emergency response services, and others as appropriate, I recommend involving all employees and inviting relevant interested parties to training and drills. Members of the emergency response team should receive the necessary role-specific training.

Emergency response training and drills can use four modes: briefing, tabletop exercise, unit training, and full-scale exercise.

A briefing may be delivered through routine explanations or training for relevant personnel, or as an oral review of the content and steps before response activities begin.

A tabletop exercise is a static simulation without operational pressure or time constraints and requires relatively few response resources. Participants work through and report each step and action as they would during a real response, allowing units to coordinate and the plan's functions to be checked.

Unit training tests or evaluates an individual response unit or part of the plan. A specific unit should practice independently under conditions that resemble reality as closely as possible, with strict control of the exercise time.

A full-scale exercise resembles unit training but links all units together to test the entire response plan. It should simulate real conditions comprehensively and normally takes longer than unit training.

I recommend integrating emergency-response content into the training system developed in “[ISO 45001 Series] Institutional Structure: Education and Training System.” Include relevant content in routine training for different positions and types of work. This helps ensure that all workers understand hazards, OH&S risks, and related actions, and that workers participate in planning, implementing, and improving measures to eliminate hazards and reduce risks, as ISO 45001 requires.

Reviewing, Revising, and Documenting the Emergency Response Plan

In addition to training and drills, a completed emergency response plan needs scheduled and event-driven review and revision to remain suitable.

Event-driven review may be needed after an emergency, when a drill review identifies a necessary correction, when a related organization experiences an emergency, or when the work environment or legislation changes. The views of interested parties must also be considered.

The communication system recommended in “[ISO 45001 Series] Institutional Structure: Communication and Retention of Documented Information” can be used to collect feedback on the emergency response plan from units across the organization. To meet ISO 45001 requirements, documented information must be retained after the response process and plan are prepared and after each review or revision.

Conclusion

Even when risk has been reduced to an acceptable level, some major hazards can still occur. No matter how low the likelihood, the OH&S management system should define what will be done if a serious event happens.

This article has focused on emergency response when a hazard occurs despite routine risks having been reduced to an acceptable level. Emergency preparedness and response should also be considered in management of change, procurement controls, and contractor or outsourcing controls so that the overall system is more complete.

ISO 45001 provides a relatively concise framework for emergency preparedness and response. Because I have built the other control measures by adapting relevant Taiwanese guidance to ISO 45001, I have likewise used the guidance as the practical detail that fills out the emergency-response framework and keeps the series consistent.

Although this article uses Taiwanese guidance to build a systematic emergency-response process and planning method, hazards differ among organizations. Effective planning therefore depends heavily on the planning team's understanding of the organization. Frontline workers should always participate in developing emergency response measures.

This is the last article in the “Plan” part of our OH&S management-system series. Next we move into the “Do” stage of PDCA: how to implement the planned controls and determine OH&S objectives under ISO 45001.

We will continue in the next article : D.

References

[1] Occupational Safety and Health Administration, Ministry of Labor, Technical Guidelines for Emergency Response Measures, 2015. [Chinese]

[2] International Organization for Standardization, ISO 45001:2018, last accessed September 5, 2026, https://www.iso.org/standard/63787.html

[3] International Organization for Standardization, ISO 45001:2018/Amd 1:2024, Climate action changes, 2024, https://www.iso.org/standard/88428.html

[4] Occupational Safety and Health Administration, Ministry of Labor, Technical Guidelines for Emergency Response Measures, last accessed September 5, 2026, https://www.osha.gov.tw/48110/48713/48735/60260/post [Chinese]

[5] Occupational Safety and Health Administration, Ministry of Labor, “Must the heading ‘Material Safety Data Sheet’ be revised to ‘Safety Data Sheet’?”, last accessed September 5, 2026, https://www.osha.gov.tw/48110/48461/48463/48469/48471/56306/post [Chinese]