Emergency Response Planning for Facility Managers

The plan you will actually use is short

Nobody reads a 200-page binder during a flood.

The first minutes of an emergency decide most of the outcome, and FEMA makes that point plainly: fast action and effective warning save lives and limit damage. What makes action fast is not the length of the plan. It is that the decisions were already made, the roles were already assigned, and the people who have to execute have practiced.

This guide builds an emergency response plan for a building rather than for an office. It assumes you are responsible for systems — fire protection, power, water, ventilation, access control, vertical transportation — and for coordinating with tenant employers who own their own occupants.

1. Start with what the regulations require

Federal workplace safety rules set the floor. An emergency action plan must be written, kept at the workplace, and available for employees to read; employers with ten or fewer employees may communicate it orally. At minimum it has to address six things:

1. How to report a fire or other emergency.
2. Evacuation procedures, including the type of evacuation and who uses which exit route.
3. Procedures for anyone who stays behind to shut down or operate critical equipment before leaving.
4. How everyone is accounted for once they are out.
5. Procedures for employees assigned rescue or medical duties.
6. The name or job title of the people who can answer questions about the plan.

Three related obligations sit alongside it. An employee alarm system must exist, be maintained, and use a distinctive signal for each purpose. Employees must be designated and trained to help others evacuate safely. And the plan must be reviewed with each covered employee when it is written, when they are hired into the job, when their responsibilities change, and whenever the plan changes. Separately, exit routes, doors, signage, and emergency lighting have to be kept usable and unobstructed at all times, and fire prevention plans carry their own requirements where they apply.

2. Run the risk assessment before you write procedures

A risk assessment identifies the hazards that could affect the property and works through what would actually happen in each scenario. FEMA’s guidance emphasizes looking specifically for vulnerabilities — weaknesses in construction, process systems, security, protection systems, and loss-prevention programs — because those are what turn an incident into a loss. Where the potential impact is significant, mitigation should be funded before response planning is polished.

Walk the building against this list. Every item is a real vulnerability found in real portfolios:

• Single points of failure in normal power, transfer switches, domestic water, sanitary lift stations, and vertical transportation.
• Standby power reality — what the generator actually carries, fuel on hand versus runtime needed, last load-bank test, and refueling contract.
• Fire protection impairments — valves closed for construction, out-of-service devices, hot-work controls, and whether a fire watch procedure exists in writing.
• Envelope and drainage — roof condition, drains and scuppers, sump pumps, below-grade penetrations, and where water goes when it gets in.
• Egress under stress — stair capacity, door hardware behavior on alarm, refuge areas, and evacuation plans for occupants with mobility, vision, or hearing disabilities.
• Notification coverage — dead zones for alarm audibility, mass notification reach, and after-hours contact accuracy.
• Dependencies — building automation, access control, and elevator monitoring that fail with the network rather than with the building.

Then rank what has to keep running. A business impact analysis, run with the operating leaders rather than by facilities alone, is what turns a hazard list into recovery priorities and tells you which systems justify redundancy.

3. The ten-step build

FEMA’s Ready Business program lays out a ten-step sequence for developing an emergency response plan. Paraphrased for a facilities audience, with the facility manager’s job in each step:

4. Pre-decide the four protective actions

Almost every building emergency resolves into one of four protective actions. Deciding which applies to which hazard in advance — and pre-scripting the system moves that support it — is the highest-value hour you will spend on this plan.

5. Command, roles, and the first fifteen minutes

Align your structure to the national incident management framework used by the responders who will arrive: one identified incident commander, a manageable span of control, and documented delegation of authority for nights, weekends, and vacations. The most common failure in building emergencies is not a missing procedure — it is three people each assuming someone else called the fire department.

A first-fifteen-minutes card, posted at the engineering office and the security desk:

1. Confirm and classify the event. Location, type, extent, people involved.
2. Protect life first. Order the protective action; do not wait for certainty.
3. Call 911, then call the internal notification tree. In that order.
4. Isolate what is making it worse. Power, gas, water, ventilation, fuel, conveyance.
5. Account for people. Sweep teams report to one person, who reports one number.
6. Control access. Stage responders, keep everyone else out, protect the scene.
7. Start a written log with times. It will matter for insurance, regulators, and the after-action review.
8. Notify leadership, tenants, and the insurer with facts only, on the pre-approved template.

6. The annexes your building needs

Keep each annex to a single page: trigger, immediate actions, who to call, and what to document. These are the scenarios that come up repeatedly in commercial and institutional portfolios.

7. Notification and crisis communication

• One source of truth. Name the single person or role authorized to issue building-wide messages, with a named backup.
• Pre-written templates. Draft the first message for each annex now: what happened, what to do, when the next update comes. Nobody writes well under stress.
• Redundant channels. Mass notification plus SMS plus email plus physical signage at entrances. Assume one channel is down.
• Accessible messaging. Visual and audible notification, and messages readable by assistive technology.
• A contact matrix you actually maintain. Tenant emergency contacts, on-call vendors by trade, utility emergency lines, alarm monitoring, insurer, restoration contractor. Re-verify quarterly; this list is stale within months.

8. Life-safety systems only work if they were maintained

Response plans quietly assume that sprinklers flow, alarms sound, extinguishers are charged, exit lights work, and the generator starts. Those assumptions are only as good as the inspection, testing, and maintenance program behind them — the water-based fire protection, fire alarm, and portable extinguisher standards all define recurring obligations, and exit routes and alarm systems must be kept functional at all times under workplace safety rules.

Two practical consequences. First, code-driven inspection and testing belongs in the same schedule as everything else, not in a vendor portal nobody opens. Second, you need a written impairment procedure: who can take fire protection out of service, what compensating measures apply, who is notified, and how the impairment is closed out. That procedure is used far more often than the emergency plan itself. The mechanics are covered in Preventive Maintenance Planning 101.

9. Train it, then exercise it

Training is a regulatory requirement, and exercising is the final step in FEMA’s process for a reason: a plan that has never been tested is a hypothesis. A workable annual cadence:

Track the corrective actions like work orders, with an owner and a due date. Exercises that generate findings nobody closes are worse than no exercise, because they document a known problem you did not fix.

10. The grab-and-go packet

One binder or tablet, one duplicate off site, reviewed twice a year:

• The plan and every annex, each one page.
• Site and floor plans marking exits, refuge areas, valve and shutoff locations, panels, and hazardous material storage.
• Utility shutoff procedures with photos of the actual valves and breakers in your building.
• Current contact matrix, including after-hours numbers.
• Fire protection impairment forms and fire watch log.
• Alarm and life-safety system inventory with last test dates.
• Insurance policy numbers and the first-notice-of-loss procedure.
• Blank incident log sheets and a camera or charged phone.
• Keys, access credentials, and the elevator key cabinet location.