Your emergency plan should be concise and unambiguous, and you should review it regularly to ensure it remains up to date.
The following points should be addressed:
-
What statutory and liability provisions and rules apply to your company in the event of an emergency?
-
Which emergencies does the plan cover? (Building fire, flooding, failure of management, extended power outage, major data breach, ...)
-
Who assumes overall responsibility in an emergency? Who are the deputies?
-
Should a crisis team be designated for emergency situations?
-
How will alerts be issued in an emergency?
-
Draw up an evacuation and rescue plan
-
Are escape routes within the company clearly and permanently marked?
-
Designate a meeting point for all persons present on the premises
-
Does your company have a fire protection concept?
-
Locations of fire extinguishers within the building
-
Include immediate first aid measures for workplace accidents in your emergency plan
-
Assessment of the extent of damage and definition of possible consequential damage
-
How will information be passed on within the company in an emergency?
-
How will customers, suppliers and neighbours be informed? Are specific communication strategies to be followed?
-
Which premises can be used as an alternative in an emergency?
-
How could emergency furnishings and replacements for machinery, technical installations or the company fleet be organised?
-
Is an emergency power supply available (e.g. generator)?
-
Is it possible to provide other replacement systems?
-
Who is able to restore failed IT systems to working order?
-
What is the procedure in the event of a cyber attack?
-
Where are backup copies stored?
-
Is the following IT data available in an emergency?
- Hostname
- System supplier
- Manufacturer
- Serial number
- Required line capacity
- Value of the system (useful for procurement)
- Components of the system such as CPU, hard drives and RAM or fibre-optic modules
- Software and software version or release status
- Passwords and login details
- IP addresses, MAC addresses of network cards
- Data backup and backup schedules
- Maintenance and licence agreements
-
Are copies of all documents necessary for the operation of the company - such as official certificates and regulatory documents (e.g. permits, certificates, safety reports, occupational health and safety documentation, inspection reports) - stored outside the company premises?
-
Are copies of all contractual documents necessary for the operation of the company (e.g. insurance policies, supplier and customer contracts) stored outside the company premises?
-
Are copies of all operational documents necessary for the operation of the company (e.g. site plans, machine layout plans, pipework plans, utility and drainage plans, hydrant locations, transformer stations) stored outside the company premises?
-
What preventive measures of a technical, organisational or personnel nature can you take to avoid an emergency? (e.g. emergency power supply, security systems, fire alarm systems, fire drill exercises, ...)
-
The emergency plan should be held on the company server and also printed and stored off-site, so that the current version is accessible to all responsible persons at all times
-
Who should be informed of the emergency plan? (When in doubt, all employees)
-
Should codes of conduct for employees in emergencies be drawn up?
-
Should emergency exercises take place within the company (e.g. evacuation drills, other employee training)?
-
If a data breach has occurred, the competent authority must be notified
-
Are there other specific reporting obligations to authorities?
-
Is coordination with the following authorities necessary or advisable?
- Fire brigade / Police
- Environmental protection, water and waste management authorities
- Occupational health and safety authority, employers’ liability insurance association (Berufsgenossenschaft)
- Building control authority
-
Do insurers need to be notified?
-
Are legal consequences to be expected for your company as a result of the emergency? (e.g. claims from customers, suppliers, employees, members of the public, companies or institutions that have suffered loss)
-
Thorough documentation of an emergency will assist you in future emergency situations and serves as evidence that reporting obligations have been met:
- Documentation of internal alerts and external notifications (e.g. to authorities)
- Decisions by the emergency team and management
- Decisions by special response units (fire brigade, police) and the authorities
- Records of conversations (e.g. with authorities) including outcomes (e.g. measures agreed)
- Documentation of measures taken and their implementation
- When was the emergency first identified?
- Causes of the emergency
- Impact of the emergency
- Evaluation of the measures carried out
-
At the end of the emergency plan, list all useful contact addresses for emergencies
-
Review the emergency plan at least once a year to check it remains up to date
-
For further information: many Chambers of Commerce and Industry (IHKs) offer free guidance online for drawing up an emergency plan