Emergency Preparedness Under ISO 45001: Planning for the Real Scenarios

I asked a Safety Manager what her emergency plan looked like for a worker having a medical event at a customer site hundreds of miles from the home office. She paused and said, "We have a plan. We just don't practice it." She wasn't being negligent - the company had written emergency procedures, trained first responders on staff, and ran fire drills at their offices every year. But the field crews who rotated between customer sites for weeks at a time? They might go an entire year without participating in a single drill that was actually relevant to the hazards they faced.

That gap between "we have a plan" and "we practice the plan" is exactly what ISO 45001 Clause 8.2 is trying to close. The standard requires organizations to establish, implement, and maintain processes for preparedness and response to potential emergency situations - and for companies with field workers, remote operations, or multiple locations, that requirement has real teeth.

More Than Fire Drills

Most companies hear "emergency preparedness" and think evacuation map and annual fire drill. And they're not wrong - that's part of it. But Clause 8.2 asks for something more active. It wants a cycle: identify potential emergency situations, plan your responses, train your people, test the plans periodically, evaluate what happened, and revise. That Plan-Do-Check-Act loop that runs through the entire standard applies here too.

A static emergency plan that was written three years ago and filed in a binder doesn't satisfy this. The standard expects a living process - one that changes when your operations change, gets tested with enough frequency to stay relevant, and generates records that show you're actually learning from those tests.

The specific requirements include identifying potential emergencies relevant to your operations, establishing planned responses including first aid provisions, providing training so workers know what to do, periodically testing the plans, evaluating performance after drills or actual events, and communicating emergency information to all workers - including contractors and visitors. That last point is easy to overlook, but auditors will check it.

Identifying Scenarios That Actually Matter

The scenarios you plan for should come from your hazard identification and risk assessment, not from a generic template downloaded off the internet. A steel fabrication shop running overhead cranes has different emergency scenarios than an industrial services company sending crews to customer sites across multiple states and provinces. A chemical processing facility has different scenarios than a construction company with workers at height.

Start with what could actually go wrong in your specific operations. If you work with hazardous substances, what happens when containment fails? If you have workers at height or in confined spaces, what does a rescue look like and who's trained to perform it? If your people work outdoors in extreme heat or cold, do you have protocols for heat stress or hypothermia? If you operate in regions prone to severe weather, are your plans tailored to the local risks - hurricanes along the Gulf Coast, tornadoes in the Midwest, wildfire smoke in the West?

One company I worked with had operations spanning across multiple states and provinces. The Safety Manager recognized that their emergency response template was too generic - it covered the basics but didn't account for the fact that the hazards in northern operations are genuinely different from the hazards in southern sites. They ended up building site-specific emergency plans for each project location, starting from a common template but tailoring the scenarios based on geography, the nature of the work, and what emergency services were actually accessible. That last point matters more than people think. An office five minutes from a fire station is a completely different situation than a remote job site where self-rescue may be the only option.

The Office vs. Field Problem

For organizations with both fixed facilities and mobile or field-based operations, emergency preparedness is really two different challenges that need two different approaches.

At the office or facility level, emergency management is relatively straightforward. You control the environment. You know the hazards. You can schedule drills, post evacuation routes, stock first aid equipment, and train people on a predictable cadence. Most companies are doing this part at least adequately - annual fire drills, first aid kits inspected, emergency contacts posted.

Field operations are where it gets complicated. When your workers are at customer sites, they're typically inducted into the customer's emergency procedures - participating in whatever drills or musters the customer runs. That's fine as far as it goes. But it creates a gap: your own company's emergency procedures may never actually get practiced by the people who need them most.

The Safety Manager I mentioned earlier described it clearly. Her field crews would be on a customer site for six to twelve weeks, then move to the next project. If the customer happened to run a drill during that period, the crew participated. If not, they didn't. Some workers could theoretically go months bouncing between sites without ever being part of a meaningful emergency exercise. The company had written plans for field emergencies - a worker collapse, a fall, an equipment failure at a remote location - but those plans had never been walked through with the people who'd need to execute them.

Her solution was practical: if a project was expected to last six weeks or more, the crew would conduct at least one emergency drill specific to their own company's procedures - not just relying on whatever the customer did. This gave them documentation showing that field workers were actually practicing the response, not just reading about it. And it surfaced gaps in the plans that would never have been found sitting in a conference room.

Testing Without Shutting Everything Down

The standard requires periodic testing, but it doesn't mandate full-scale drills for every scenario. For production environments, shutting down a line for a drill has real cost implications. For field operations, pulling a crew off a customer's project for training needs coordination. There are practical alternatives that still satisfy the requirement:

Tabletop exercises. Gather the response team and walk through a scenario verbally. "It's Tuesday at 2 PM, a forklift punctures a drum of hydraulic fluid in the warehouse. What happens next? Who does what? Where's the spill kit? Who calls the fire department?" This takes 30 minutes, doesn't stop operations, and often reveals gaps that a physical drill would miss because people have time to think through the sequence.

Component drills. Test individual elements without running the full scenario. Activate the emergency notification system and see if everyone gets the alert. Have first responders demonstrate AED use. Walk a new shift through the evacuation route and assembly point. These targeted exercises build competence without major disruption.

Full-scale drills for critical scenarios. Some scenarios need the real thing - a full evacuation at least annually is standard practice and usually required by local fire codes anyway. I was working with a manufacturing client who ran their first proper evacuation drill and it took far longer than anyone expected to get everyone out of the facility. In a real fire, that's far too long. The drill produced a laundry list of issues they never would have identified on paper - blocked exit paths, confusion about assembly points, workers who didn't hear the alarm in certain parts of the shop. That's exactly the kind of finding that makes full-scale drills worth the disruption.

What Counts as a Record

This trips people up more than it should. The standard wants evidence that you're testing your plans and learning from the results. That means drill records need more than a sign-in sheet with a head count.

A useful drill record captures what scenario was tested, when and where, who participated, what went well, what didn't, and what actions came out of it. The "what didn't" part is the most valuable. If the drill went perfectly, great - document that. If the alarm wasn't audible in the break room, or the first aid kit was expired, or nobody knew who was supposed to call 911 versus who stays to do a head count - those findings become your improvement actions, and following through on them is what the auditor wants to see at the next Surveillance Audit.

For field workers who participate in customer-run drills, the records challenge is different. One company's approach was to have Site Supervisors note any emergency drills or actual events in their daily reports. It's not a formal drill evaluation, but it creates a traceable record that workers were exposed to emergency procedures during their time on site. Combined with the company-initiated drills on longer projects, it showed reasonable coverage. If you're trying to build a culture where near-miss reporting and drill findings actually drive improvement, this kind of documentation is what connects the dots.

Keeping Plans Current

Emergency plans have a shelf life. They need updating when operations change - new processes, new chemicals, new equipment, facility modifications, changes in shift patterns or staffing levels. This is where emergency preparedness connects to Management of Change. If you add a powder coating line that introduces combustible dust, your emergency plan needs to reflect that hazard. If you go from two shifts to three, your first responder coverage needs to adjust. If you open a new project site in a region with different hazards, the field emergency plan needs to be tailored accordingly.

Building an emergency plan review into your Management of Change process prevents the drift that happens when plans are written once and filed. Every significant operational change should trigger a simple check: does this affect any of our emergency scenarios or response procedures? It takes five minutes and prevents the slow disconnect between what's documented and what's real. This is the same principle behind tracking leading indicators - proactive checks that catch problems before they become incidents.

What Auditors Look For

During a Certification Audit, the auditor will evaluate your emergency preparedness by looking for:

• A documented list of potential emergency scenarios relevant to your actual operations - not a generic template
• Response procedures for each scenario with clear roles and responsibilities
• Evidence of training - who was trained, on what, and when
• Records of drills with dates, scope, participants, findings, and follow-up actions
• Evidence that plans were revised after drills or actual incidents
• Communication of emergency procedures to contractors and visitors
• First aid provisions and inspection records

The auditor may also walk the facility and check that emergency equipment is accessible, exit routes are clear, assembly points are marked, and workers on the floor can describe what they'd do in an emergency. For organizations with field operations, expect questions about how you ensure those workers are covered too. A good answer shows that you've thought about it and have a systematic approach, even if it's not identical to what you do at the home facility. If you're preparing for your first audit, a thorough Gap Analysis will help you identify where your emergency preparedness stands relative to the standard's expectations.

For a broader look at how OSHA frames emergency preparedness and response, their guidance covers regulatory requirements that often overlap with what ISO 45001 asks for - particularly around evacuation plans, emergency action plans, and first aid provisions.

Getting Started

If your emergency preparedness today is a fire evacuation plan and an annual drill, start with an honest inventory. Walk your facilities. Think about your field operations. Ask your workers and supervisors what they'd actually do if something went wrong - not what the binder says, but what would happen in practice. The gap between those two answers is where the real work lives.

Write practical response procedures - not a 50-page manual nobody will read. Schedule a mix of tabletop exercises, component drills, and at least one full-scale drill per year. Vary the scenarios. And critically, evaluate after every event and update the plan. That continuous improvement cycle is what the standard is really after, and it's what turns emergency preparedness from a compliance checkbox into something that could actually save someone's life. Building strong worker participation into these exercises - not just attendance, but genuine input on what works and what doesn't - is what separates a real safety culture from one that just looks good on paper.

If you're building your ISO 45001 emergency preparedness program or preparing for a Certification Audit, we offer a free initial consultation to help you figure out where you stand.