Emergency Action Plans: What Businesses Need and What OSHA Requires

An Emergency Action Plan (EAP) is a written document that sets procedures for responding to workplace emergencies. OSHA requires most employers to have one. The requirement exists for good reason: organized, rehearsed responses consistently outperform improvised ones in both speed and outcomes.

When OSHA Requires an Emergency Action Plan

OSHA's Emergency Action Plan standard (29 CFR 1910.38) requires employers to have a written EAP if certain standards apply to their workplace. These include standards covering:

• fire suppression systems
• sprinkler systems
• fixed extinguishing systems
• fire detection systems
• employee alarm systems

Employers with 10 or fewer employees may communicate the EAP orally rather than in writing. Employers with more than 10 employees must keep it in writing and make it accessible to staff.

Even without a specific trigger, having a written EAP reflects reasonable care under OSHA's General Duty Clause. An employer whose workers were injured in an emergency without a response plan would face significant legal and regulatory exposure.

What a Complete Emergency Action Plan Contains

Procedures for reporting emergencies. How do employees report a fire, medical emergency, workplace violence incident, or other emergency? Who do they call first? What information should they provide?

Procedures for evacuation. Evacuation routes, assembly points, and procedures for employees who need assistance. Different scenarios may require different routes. A fire in the east wing has different implications than a fire at a main exit.

Procedures for employees who may remain. In some scenarios, certain employees stay to perform critical functions before evacuating, such as shutting down hazardous operations. These employees need specific instructions. They must not be required to remain in situations that put them at risk.

Procedures for accounting for all employees. Assembly point procedures, headcount protocols, and the process for reporting employees who cannot be accounted for.

Procedures for employees performing rescue or medical duties. If any employees are designated to perform first aid or assist in emergencies, their roles should be documented. They should also receive proper training.

Names and contact information for key personnel. Who is responsible for the plan and who employees should contact with questions.

The preferred means for reporting fires and other emergencies. In larger facilities, where to report an emergency may not be self-evident.

Training Requirements

A written plan is necessary but not sufficient. OSHA requires that employers train employees to understand the plan and their role in it. Employees who cannot find evacuation routes, do not know the assembly point, or do not know how to report an emergency are not prepared, even if the plan exists on paper.

Training should occur:

• when the plan is first developed
• when employees are hired
• when the plan is changed
• when practice or incidents show employees need a refresher

Plan Maintenance

Emergency Action Plans require maintenance. Facilities change, personnel change, and contact information changes. A plan that was accurate when written may direct employees to exits that no longer exist or list contacts who have left the organization.

Regular review keeps the plan accurate, at minimum annually and whenever significant changes occur. Drills verify that the plan works in practice, not just in theory.

Beyond Compliance: Scenario-Specific Planning

OSHA's requirements set a floor, not a ceiling. Better-prepared organizations identify and plan for the specific emergencies most relevant to their environment, including:

• active shooter events
• medical emergencies
• severe weather
• facility-specific hazards

Treating the minimum requirement as the goal leaves gaps.

Conducting a Hazard Assessment Before You Write the Plan

The strongest Emergency Action Plans begin with a structured hazard assessment, not a template pulled from the internet. A plan that addresses hazards that do not exist at your facility while ignoring the real ones creates a false sense of readiness. A hazard assessment walks through the physical site, the surrounding environment, the workforce, and the operations to find what could actually go wrong.

Consider a distribution center near a major highway and a rail line carrying hazardous materials. That facility faces shelter-in-place risks from chemical spills that an office tower in the same city does not. A manufacturing plant with propane forklifts, paint booths, or dust collection systems faces internal fire and explosion hazards that a professional services firm does not. A school in a tornado-prone region must plan for severe weather differently than a school in coastal Florida, where hurricane warnings arrive days in advance.

The assessment should examine:

• building construction
• exit paths and stairwells
• elevator behavior during alarms
• assembly areas
• neighboring occupancies
• historical incidents at the site
• the presence of high-value or high-risk assets

Our security consulting team performs facility assessments that identify these exposures and tie them back to concrete plan provisions rather than generic language. That process also surfaces gaps in access control, camera coverage, and visitor management that often become relevant during emergencies and their aftermath.

Planning for Workplace Violence and Active Threats

Workplace violence is a commonly cited gap in otherwise mature Emergency Action Plans. Fire and medical emergencies are familiar and easier to plan for. A threatening former employee, a domestic-violence situation that migrates into the workplace, or an active assailant requires a different set of procedures and a different kind of decision-making under stress.

Effective planning for these scenarios distinguishes clearly between evacuation, shelter-in-place, and lockdown. Employees need to understand which response matches which threat, how the decision is communicated, and what to do if the threat blocks their usual evacuation route. Run-hide-fight guidance, developed by federal law enforcement, is the baseline framework. The framework only works when employees have rehearsed it in the actual building they work in.

Planning should also address the precursors to violence, not only the response to it. The likelihood of an incident drops with:

• a documented threat-assessment protocol
• a defined process for reporting concerning behavior
• a relationship with investigators who can quickly evaluate a threat

When a specific employee, former employee, or third party raises concerns, our executive misconduct and threat investigation services help organizations determine whether behavior has crossed into territory that warrants intervention, added security measures, or law enforcement referral.

Communications and Notification During an Emergency

A plan that cannot reach employees within seconds of an incident is a plan that fails in real conditions. Modern Emergency Action Plans rely on multiple, redundant communication channels because any single channel can fail. Fire alarms announce fires but do not distinguish between evacuation and shelter-in-place. Public address systems fail when power is lost. Cell networks congest during large incidents. Email reaches desks but not warehouses or loading docks.

Mass notification platforms that push messages to mobile devices, desk phones, and overhead speakers at the same time are now the standard for organizations of any size. Whatever system is used, the plan should specify:

• who is authorized to send notifications
• what pre-scripted messages exist for common scenarios
• how messages are updated as the situation evolves

Pre-scripted messages matter because drafting clear, accurate guidance during an active emergency is hard. Inconsistent messaging from different leaders produces confusion at exactly the wrong moment.

External communications also require planning. Emergencies attract inquiries from employees' families, clients, media, regulators, and sometimes law enforcement. A plan that designates a single spokesperson, identifies backup spokespeople, and routes other staff away from media contact prevents off-message statements that complicate both response and recovery.

Coordinating With First Responders and Local Agencies

Emergency Action Plans should not exist in isolation from the first responders who will arrive on scene. Local fire marshals, police departments, and emergency medical services often welcome the chance to walk through a facility, review the plan, and identify issues before an incident occurs. Pre-incident familiarity with a building, its utility shutoffs, its hazardous materials storage, and its access points significantly improves response time.

Larger facilities, campuses, and multi-tenant properties benefit from a formal site information packet kept for first responders, including:

• floor plans
• utility diagrams
• Knox box locations
• alarm panel locations
• current contact numbers for facility management

Schools, in particular, should coordinate their plans with local law enforcement and provide updated floor plans annually. When incidents do occur on school property, investigations that reach beyond a single district may be necessary. Our out-of-district investigations for schools support administrators in those situations.

Drills, After-Action Reviews, and Continuous Improvement

A plan is only as strong as the last drill that tested it. Annual fire drills meet a minimum requirement but rarely reveal the problems that matter most:

• whether supervisors actually perform headcounts
• whether designated shelter-in-place rooms can fit everyone assigned to them
• whether visitors and contractors are accounted for
• whether employees with mobility limitations have workable evacuation plans

Tabletop exercises complement physical drills by walking leadership through scenarios that are impractical to rehearse fully, such as a bomb threat, a cyber incident that disables building systems, or an extended power outage during severe weather. After every drill and every real incident, a short, honest after-action review captures what worked, what did not, and what changes the plan requires. Organizations that treat after-action findings as mandatory inputs to plan revision, rather than optional suggestions, improve measurably over time.

Our training team develops comprehensive emergency response planning for organizations of all sizes, including active shooter protocols and evacuation procedure training. Corporate clients pair the plan and training with our security consulting team on facility assessments, workplace-violence programs, and threat-assessment protocols, so the plan sits inside a broader readiness program rather than standing alone. Contact us to discuss your planning needs.