Emergency and Incident Response SOPs: What They Are, Examples, and How to Write One

The alarm sounded at 2:40 a.m. on a Sunday. The night shift lead had been with the company for eleven weeks. The emergency action plan was in a binder in the EHS office, which was locked. The laminated map by the door showed the old muster point, from before the warehouse extension. Two contractors were on site that nobody had counted. Everyone got out, as it happens, and the fire turned out to be a seized motor on the dust collector. The debrief produced eleven findings, and every one of them could have been written down in advance.

Nothing in that story is unusual. It is what happens when the emergency plan exists and the emergency procedures do not.

Most organizations have a plan. Far fewer have procedures. The plan satisfies the regulator and the auditor: it names the alarm, the exits, the assembly areas, and who to call. It does not tell an eleven-week shift lead what to do in the first sixty seconds, or what has to happen in the eight hours after the fire is out, when the regulatory clocks are already running.

Emergency and incident response SOPs close that gap. This guide, the eighth in our series on the types of SOPs, covers what an emergency and incident response SOP is, how it differs from the plan above it and the safety procedures beside it, which scenarios to write first, what belongs inside each one, and a seven-step method for writing procedures that work for a reader who is frightened, in the dark, and has thirty seconds.

Quick answer: An emergency and incident response SOP (standard operating procedure) is a written, step-by-step instruction for what people must do when something goes wrong: the first minutes of an alarm, evacuation, spill, fire, medical emergency, or security threat, and the hours after, when the scene is secured, the right people and regulators are notified, and the investigation begins.

Key takeaways

• Emergency and incident response SOPs cover two phases: the minutes during an event (alarm, evacuation, spill, fire, medical emergency) and the hours after it (reporting, notifications, investigation, corrective action).

• A plan is not a procedure. The emergency action plan (EAP) that the Occupational Safety and Health Administration (OSHA) requires under 29 CFR 1910.38 is the site-wide framework. The SOP is the role-level instruction a shift lead follows at 2 a.m.

• These are the only SOPs read under stress. Write the first sixty seconds as a one-page, decision-first card, and keep the supporting detail behind it.

• The clock starts whether you are ready or not. OSHA requires a work-related fatality to be reported within 8 hours and an in-patient hospitalization, amputation, or loss of an eye within 24 hours. The U.S. Chemical Safety Board requires qualifying chemical releases to be reported within 8 hours.

• The U.S. Bureau of Labor Statistics counted 5,070 fatal work injuries in 2024, and the Federal Emergency Management Agency estimates about 25% of businesses never reopen after a disaster.

• Drills are the review mechanism. An emergency SOP that has never been exercised is a hypothesis, and every drill, incident, near miss, and layout change should reopen it.

What is an emergency and incident response SOP?

An emergency and incident response SOP is a standard operating procedure for a foreseeable bad day. It takes a scenario your hazard assessment says could happen (a fire in the dust collector, a forklift collision with an injury, a drum of acid split on the receiving dock, a tornado warning, a threat at the gate) and converts it into named roles, ordered actions, notification steps with deadlines, and the records that prove each step happened.

If the term SOP itself is new ground, start with our plain-language guide to what an SOP is and come back; this article assumes the basics and goes deep on one category.

A plan is not a procedure.

OSHA's emergency action plan standard, 29 CFR 1910.38, requires a written plan whenever another OSHA standard calls for one. At minimum it must cover how to report a fire or other emergency, evacuation procedures with exit route assignments, what employees who stay to operate critical operations must do before evacuating, how everyone is accounted for afterward, rescue and medical duties, and who to contact about the plan. Employers with 10 or fewer employees may communicate it orally.

That is a plan. It describes what will happen, site-wide, for the regulator and the auditor. A procedure describes what you, in this role, on this shift, do first, second, and third, and what you must never do. The plan says employees will evacuate via assigned exit routes to designated assembly areas. The floor warden's SOP says: sweep bays 3 and 4 including the restroom, close doors behind you, take the clipboard from the hook by exit C, report your count at muster point B, and do not re-enter until the incident lead says so.

Organizations that stop at the plan have met the letter of the standard and left the actual response to improvisation.

Two halves: during and after.

Emergency response SOPs cover the minutes: alarm and evacuation, shelter-in-place and lockdown, fire response, chemical spills and releases, medical emergencies and first aid, utility failures, severe weather. Incident response SOPs cover what happens once the immediate danger has passed: making the scene safe and preserving it, first-hour reporting, the regulatory notification clocks, witness statements, the handoff to investigation, corrective and preventive action (CAPA), and the return to normal operations.

Most organizations write some of the first half and almost none of the second, which is why the hours after an incident are so often more chaotic than the incident itself. Our guide to connecting incident reporting, audits, and corrective actions covers that after-phase in depth; this article covers the procedures that feed it.

How are emergency and incident response SOPs different from other SOP types?

Every SOP type shares the same skeleton: numbered steps, named roles, a revision block. What changes is the risk each type controls. An operational SOP protects the consistency of your core work, a quality SOP protects the product, a safety SOP prevents harm during planned work, and a compliance SOP proves the rules were followed. An emergency and incident response SOP exists for the moment prevention fails: it limits the harm, then gets the organization through the aftermath in the right order.

The column on the right has one property the others do not: it is never read in the conditions it was written in. A safety SOP is read at a workbench, with coffee, before a familiar task. An emergency SOP is read, if it is read at all, by someone whose heart rate has doubled, in smoke or in the dark, who may not even be the person it was written for, because that person is on vacation. Every design choice follows from that: shorter, bigger, decision first, posted at the point of use, and rehearsed until the page is barely needed.

In practice the categories overlap, and that is fine. A spill procedure borrows its personal protective equipment (PPE) and handling steps from your safety SOPs. An emergency shutdown sequence belongs equally to your maintenance SOPs. Post-incident notifications are compliance SOPs by another name, and drill attendance and first-aider certifications are records your HR and training SOPs govern. Write one SOP for the scenario and tag it into every category it touches, a point our types of SOPs guide makes across all ten types.

Seconds are the unit of measure, and the clock runs either way.

The U.S. Bureau of Labor Statistics (BLS) recorded 5,070 fatal work injuries in 2024, down 4.0% from 5,283 the year before, a rate of 3.3 deaths per 100,000 full-time equivalent workers. Of those, 687 were from exposure to harmful substances or environments. Not every one was an emergency a procedure could have changed, but in many the difference between a near miss and a fatality came down to how long it took someone to decide what to do.

The financial picture is just as blunt. The National Safety Council (NSC) puts the total cost of work injuries in 2024 at $181.4 billion, with a cost per medically consulted injury of $48,000 and a cost per death of $1,540,000. Those figures do not include the plant that cannot restart because nobody knew the shutdown sequence.

An emergency is also a business continuity event. The Federal Emergency Management Agency (FEMA) has estimated that about 25% of businesses do not reopen after a disaster. The ones that do tend to be the ones that decided, in advance and in writing, who does what when the power fails.

The clock starts whether you are ready or not.

The hours after an incident carry legal deadlines that do not pause while you look for the binder. Under OSHA's reporting rule, 29 CFR 1904.39, a work-related fatality must be reported to OSHA within 8 hours, and an in-patient hospitalization, amputation, or loss of an eye within 24 hours. If your site handles hazardous chemicals, the U.S. Chemical Safety Board (CSB) requires under 40 CFR Part 1604 that any accidental release resulting in a fatality, a serious injury, or property damage estimated at $1,000,000 or more be reported within 8 hours. Releases of listed substances above their reportable quantities trigger immediate notification to the National Response Center and to state and local emergency planners.

Miss a deadline and you have stacked a second violation on top of the first. OSHA's 2026 penalty schedule runs to $16,550 per serious violation and $165,514 per willful or repeated one, and failing to have a required emergency action plan is itself citable. A procedure that puts the clocks, the phone numbers, and the decision owner on one page is what keeps a reportable event from becoming a case study.

Nobody reads a procedure for the first time during a fire.

Why do emergency procedures stay unwritten?

Because emergencies are rare, and rarity removes the daily friction that gets other procedures written. An evacuation that has never gone wrong generates no complaints, until it does. Because the plan exists, and the binder that passed the last audit makes the box feel ticked.

Because people believe emergencies are too varied to proceduralize. The opposite is true. The first sixty seconds of a fire, a spill, a medical collapse, and a gas leak are remarkably similar: raise the alarm, get people out or into shelter, count them, and call the one person whose job is to run the rest. What varies is the detail behind those steps, and that is exactly what a procedure holds.

And because ownership is diffuse. EHS owns the plan, facilities owns the alarms and shutoffs, security owns the gate, HR owns the headcount, and the night shift owns the actual emergency. Procedures are how those owners agree, in advance, on who does what.

Which emergency and incident response SOPs should you write first?

No site needs forty emergency procedures by Friday. Across industries, the highest-value emergency and incident response SOPs cluster into six families. Start where your hazard assessment says the risk is, and where the legal clocks are shortest.

1. Alarm, evacuation, and accounting. The general evacuation procedure, floor warden sweep routes, muster points, the headcount method, help for people with mobility or sensory impairments, and the rule for contractors and visitors. Start here: every person on site will run it, and 1910.38 requires most of it anyway.

2. Medical emergencies and first aid. The trained first aiders on each shift, where the automated external defibrillator (AED) and first-aid kits live, the eyewash and drench shower rule for chemical exposure, and how to call emergency services and guide them to the casualty.

3. Chemical spills and releases. The line between a minor spill a trained person cleans up and a major release that means evacuate and call, built from the safety data sheet (SDS) for each substance you hold, with PPE, containment, waste handling, and reportable-quantity decisions.

4. Fire, explosion, and utility failure. Fire response and the limits of extinguisher use, emergency shutdown of critical operations, gas and electrical isolation, power loss and restart, and loss of water, ventilation, or refrigeration. This family overlaps heavily with your maintenance procedures.

5. Severe weather, natural hazards, and security threats. Shelter-in-place for tornado and chemical plume, lockdown and active-threat response, bomb threats, flooding, and extreme heat or cold. These are the scenarios most often covered by a policy paragraph and nothing else.

6. Incident reporting, notification, and investigation. The first-hour actions after any event: making the scene safe and preserving it, the incident report, the notification ladder with its deadlines, witness statements, the handoff to investigation and CAPA, and the return to normal operations. Lowest glamour, highest legal exposure.

Two rules set the order inside the families. Follow the hazard assessment: the scenarios your risk register rates highest get procedures first, whatever the template says. And follow the clocks: any event that could trigger an 8-hour or 24-hour reporting duty needs its after-phase procedure written before the event, because writing it during the event is too late.

What does an emergency and incident response SOP include?

Format matters more here than for any other SOP type, because the reader has no time, but the content still comes down to ten building blocks:

1. Title, unique ID, and one scenario per document, such as SOP-803 Chemical Spill Response, so nobody is flipping between fire and flood instructions mid-event

2. Purpose, scope, and activation criteria: which areas and shifts it covers, what counts as this emergency, and who can declare it, with "when in doubt, activate" as the default

3. Roles with named backups per shift: incident lead, floor wardens, first aiders, spill team, communications, plus the line that matters most: if you are not on this list, your job is to evacuate

4. Definitions and alarm signals: acronyms spelled out, and which tone or announcement means evacuate, shelter, or all clear

5. The first-sixty-seconds box: the immediate actions, in order, imperative, decision-first, on one page in large type

6. Routes, muster points, and the accounting method: primary and alternate exits, shelter locations, how the count is taken, and what happens when someone is missing

7. The notification ladder with the clocks: internal escalation, emergency services, regulators with deadlines and phone numbers, and the one person authorized to speak to media

8. Equipment and resources: spill kits, extinguishers, AEDs, PPE, shutoff valves, SDS access, with locations and who inspects them

9. Stand-down, scene preservation, and the handoff: who declares all clear, what must not be touched or moved, photographs and witness statements, the incident report, and the trigger that opens an investigation

10. Revision block, drill schedule, and review triggers: version, owner, approver, effective date, drill cadence, and the events that reopen the document early

Two of these blocks do the heavy lifting, and they are the two most often missing.

The first-sixty-seconds box turns a document into a response. Everything else in the SOP supports one page: the ordered actions a person takes in the first minute, written as commands, with the decision that matters (evacuate or respond, shelter or leave) placed first. If a floor warden can act correctly from that page alone, the SOP works. If they have to read three pages of scope to find the instruction, they will do whatever they did at their last job.

The notification ladder makes the aftermath defensible. Who calls whom, in what order, within what time, with which facts, and who records that the call was made. The ladder is where the 8-hour and 24-hour clocks live, where the CSB and environmental triggers are spelled out, and where it is written that only the named spokesperson talks to the press. In the hours after an incident, this page protects the organization more than any other document it owns.

What does an emergency and incident response SOP look like in practice?

Here is the skeleton of a real one, trimmed for space.

SOP-803: Chemical spill response (v3.0, owner: EHS Manager, review due: after the next live drill or October 2027, whichever comes first). Purpose: one consistent response to a spill, from first sight to closed investigation. Scope: all production, warehouse, and receiving areas on all shifts; laboratory spills follow SOP-804. Activation: a minor spill is a known, non-reactive liquid under the volume limit in the site spill register, contained in a bunded area, with no vapors, fire risk, drain reach, or injured person; anything else, or any doubt, is a major release. Roles: the first person on scene raises the alarm; the shift incident lead declares minor or major; the trained spill team (two per shift, named on the shift board) handles minor spills only; floor wardens sweep and count; the EHS Manager owns notifications. First sixty seconds: alert people nearby, step back and upwind, do not touch or walk through the material, and if major, activate the alarm, evacuate to muster point B (muster point A is downwind of receiving), call 911, and attempt no cleanup. Minor spills: the spill team dons the PPE listed in Section 8 of that substance's SDS, contains and absorbs with the nearest kit, bags and labels the waste as hazardous, and logs the event. Notifications: the incident lead calls the EHS Manager within 15 minutes of any activation; the EHS Manager checks the quantity against the site register and makes environmental notifications immediately if a threshold is exceeded; any injury starts the OSHA clock and any qualifying release starts the CSB clock, both tracked on the notification log. After: the scene stays untouched until the EHS Manager releases it, the incident report is completed before the end of the shift, an investigation opens within 24 hours, and every corrective action goes into the CAPA tracker.

Nothing in it is inventive, and that is the point. The night shift runs the same first sixty seconds the day shift does, the newest warden knows which muster point is upwind, the regulatory clocks are started by someone whose job it is to start them, and proof that the response followed the procedure takes minutes to produce, not a search party.

How to write an emergency and incident response SOP in 7 steps

The method matters more than the template, and for emergency procedures the method starts with your hazards and ends with a drill.

1. Start from your hazard assessment and your plan, not from a template. List the credible scenarios for this site: fire, spill, medical, utility failure, severe weather, security. Your EAP or emergency response plan is the parent document; each SOP is a child of it, one scenario each. For chemicals, decide first whether you are an evacuate site or a respond site, and for which substances: under OSHA's hazardous waste operations and emergency response standard (HAZWOPER, 29 CFR 1910.120), sites whose employees respond to releases need a written emergency response plan, while sites that evacuate everyone and let no employee assist are exempt if they have an EAP.

2. Set the activation criteria and name who can declare. What counts as this emergency, what the thresholds are, and who has the authority to call it. Default to "when in doubt, activate," because the most dangerous minute in any emergency is the one spent debating whether it is one.

3. Write the first sixty seconds first. One page, large type, imperative sentences, the key decision at the top. Draft it with the people who will use it, especially night-shift and newer staff, because it has to work for the least experienced person who could be first on scene.

4. Build the notification ladder with the clocks on it. Internal escalation, emergency services, regulators with deadlines and numbers, neighbors where relevant, and the named spokesperson. Pre-write the scripts: what the caller says to 911, what the incident lead sends to leadership, what the front desk says to anyone who asks.

5. Map the equipment and the people, shift by shift. Muster points, routes, kits, AEDs, extinguishers, shutoffs, and the named backups for every role on every shift, including weekends and the days the EHS manager is away. A procedure that only works on day shift is not a procedure.

6. Write the after. Stand-down and all clear, scene preservation, the incident report, witness statements, the investigation handoff, CAPA, and the steps back to normal operations. Link it to your CAPA investigation process so a finding from the debrief becomes a tracked action rather than a good intention.

7. Drill it, then fix it, then set the review triggers. Walk it through as a tabletop exercise first, then run it live. Every drill produces a debrief and a revision, because the gaps a drill exposes are the gaps the real event would have exposed. Then tie reviews to events as well as the calendar: any incident or near miss, a layout change, a new chemical, a change in staffing or alarm system, and at least annually.

The emergency SOP that fails is the one nobody has read since the last drill.

Emergency procedures rarely fail because they were badly written. They fail because the site changed and the procedure did not. The warehouse extension moved the muster point. The named first aider on nights left in March. The spill kit was relocated when the racking went in. The notification ladder still lists the number of a plant manager who retired. None of these changes announced themselves, and the laminated card by the door still looks authoritative.

The consequences are sharper here than in any other SOP family: an operational procedure that drifts produces rework, while an emergency procedure that drifts produces a headcount that does not add up at the wrong muster point. We dissected what documentation drift costs in the hidden cost of uncontrolled SOPs, and emergency procedures are a favorite victim precisely because they are so rarely opened.

The countermeasures are familiar, applied with more urgency. Every emergency and incident response SOP gets one named owner and a deputy. Drills are treated as the review, with every debrief producing a dated revision. Every procedure lives in one place that every shift can search, with the first-sixty-seconds card printed at the point of use and superseded versions taken off the wall the day a new one is approved. Purpose-built SOP management software makes this structural rather than heroic: one current version of each procedure, acknowledgments tracked by name and shift, and review dates that nag the owner instead of relying on memory. However you solve it, solve the point of use first. A procedure that lives only on a server is unavailable in exactly the situations it was written for: a power failure, a fire in the office, a shift lead who has never logged in.

In short, one current version on every wall beats a perfect version in a locked office, every time.

The bottom line

Emergency and incident response SOPs are where your emergency plan stops being a document and starts being a response. They decide whether the eleven-week shift lead knows what to do at 2:40 a.m., whether the headcount at the muster point is right, whether the spill is handled by the people trained for it, and whether the 8-hour clock is started by someone who knew it existed.

Start with six documents: evacuation and accounting, medical emergencies, chemical spills, fire and utility failure, weather and security threats, and the incident reporting and notification procedure that follows all of them. Write the first sixty seconds as a one-page card, put the notification ladder and its clocks beside it, name the backups for every role on every shift, and drill each one until the page is barely needed.

Your plan already promises that people will be safe when something goes wrong. Procedures are how the promise gets kept, on every shift, long after the person who wrote the plan has moved on.

Frequently asked questions

What is an emergency and incident response SOP?

An emergency and incident response SOP (standard operating procedure) is a written, step-by-step document for what people must do when something goes wrong, covering both the first minutes of an event (alarm, evacuation, spill, fire, medical emergency, severe weather, security threat) and the hours after it (securing the scene, reporting, regulatory notifications, investigation, corrective action, and recovery). It names who does each step, in what order, within what time, and the record that proves it happened.

What is the difference between an emergency action plan and an emergency response SOP?

An emergency action plan (EAP) is the site-wide framework OSHA requires under 29 CFR 1910.38: how emergencies are reported, evacuation routes, how employees are accounted for, rescue and medical duties, and who to contact. An emergency response SOP is the role-level instruction that makes the plan work: what a floor warden, first aider, spill team member, or shift lead does first, second, and third in a specific scenario. The plan describes the system; the SOPs describe the jobs inside it.

What are examples of emergency and incident response SOPs?

Common examples include general evacuation and headcount, shelter-in-place and lockdown, fire response and emergency shutdown, chemical spill and release response, medical emergency and first aid, utility failure and restart, severe weather response, bomb threat and active threat response, and the incident reporting, notification, and investigation procedure that follows any event. Any scenario in your hazard assessment that would require people to act quickly and in a set order is a candidate.

Are emergency response SOPs required by law?

The procedures themselves are rarely named in regulation, but much of what they contain is required. OSHA requires an emergency action plan whenever another standard calls for one, and a written emergency response plan under HAZWOPER where employees respond to hazardous substance releases. OSHA also requires fatalities to be reported within 8 hours and hospitalizations, amputations, or loss of an eye within 24 hours, and the Chemical Safety Board requires qualifying releases to be reported within 8 hours. ISO 45001, the international occupational health and safety management standard, requires organizations to plan, test, and revise their emergency response. Written procedures are the practical way to meet those duties by design rather than by luck.

How long should an emergency SOP be?

The part people use in the moment should fit on one page: the activation decision, the first sixty seconds of actions in order, the routes and muster points, and the first calls to make. Supporting detail (roles and backups, equipment locations, the full notification ladder, the after-incident steps, and the revision block) belongs in the same document behind that page, where it can be studied in training and drills rather than read during the event.

How often should emergency SOPs be drilled and reviewed?

Drill each scenario at least annually, with tabletop exercises in between for every shift, and treat every drill as a review: the debrief should produce a dated revision. Reopen the procedure immediately after any incident or near miss, a layout or process change, a new chemical, a change in staffing or shift pattern, a change in the alarm system, or a change in the regulations it references. Because emergency procedures are so rarely opened between drills, event-based triggers matter more than the calendar.

Who should write emergency and incident response SOPs?

The EHS lead owns them, but they should be drafted with the people who will run them: floor wardens, first aiders, the spill team, facilities and security staff, and the newer and night-shift employees most likely to be first on scene. Local fire and emergency services can review routes, access, and the information they will need on arrival. Sign-off belongs to the EHS lead and the site leader, because the procedures commit the whole site, not one department.

Want every shift to run the same first sixty seconds? ForgeSOP keeps every emergency and incident response SOP versioned, acknowledged, and findable at the point of use.