INGO ADVISORYIndependent Security Intelligence & Risk Analysis

Security management · Crisis and incident management

The first hour decides how the rest of the incident goes

Crisis management is mostly sequence and discipline: log the time, separate fact from assumption, account for people, escalate to the person who can decide, and review honestly afterwards.

Illustrative analytical example — demonstrates method, not operational guidance for a specific organisation. No real incident, organisation or procedure is described, and no emergency response service is offered.

Six-phase sequence

  1. Phase 1

    Detection

    • Incident reported through any channel and logged with the time of first report.
    • Duty holder identified immediately; no waiting for confirmation before opening a log.
    • Initial facts separated from assumption in the first written entry.

  2. Phase 2

    Verification

    • Confirm what is known through available and independent sources.
    • Record confidence for each fact: confirmed, reported or assessed.
    • Avoid amplifying unverified detail into the organisation or externally.

  3. Phase 3

    Immediate actions

    • Account for all personnel against a current presence list.
    • Establish and hold a single communications channel.
    • Reassess the threat to anyone still exposed and move people out of danger.

  4. Phase 4

    Escalation

    • Notify the decision-makers named in the plan, not everyone at once.
    • State clearly what decision is required, by whom and by when.
    • Convene the crisis-management team with defined roles and a scribe.

  5. Phase 5

    Response

    • Implement the relevant contingency arrangement and record each decision.
    • Manage staff care, family liaison and internal communication deliberately.
    • Coordinate with authorities, partners and coordination bodies as appropriate.

  6. Phase 6

    Recovery and review

    • Stand down formally and confirm continuing duty-of-care obligations.
    • Run an after-action review that tests assumptions, not individuals.
    • Update the risk assessment, controls and thresholds, and reissue with a date.

Illustrative scenarios

Each scenario is fictionalised. The purpose is to show which decisions a crisis-management team would face, and in what order.

Major security incident affecting a capital-city office

Setting
Urban capital, mixed national and international team, single office site.
Trigger
An explosive incident on the approach road during working hours.
Decisions required
  • Whether to shelter in place or evacuate the site.
  • How to account for staff off-site and in transit.
  • When and how to communicate internally before facts are confirmed.

Staff unaccounted for after a field movement

Setting
Inter-city corridor with intermittent communications coverage.
Trigger
A scheduled check-in is missed by more than the agreed window.
Decisions required
  • When the no-contact procedure becomes an incident.
  • Who is authorised to contact authorities and partners.
  • Whether other movements pause pending clarification.

Access denial at a distribution point

Setting
Rural district with contested control and community expectation of assistance.
Trigger
An armed actor blocks a distribution and demands beneficiary lists.
Decisions required
  • Whether to suspend, relocate or defer the activity.
  • How to hold data-protection and principled red lines under pressure.
  • How to communicate the suspension to the community.

Rapid deterioration requiring relocation planning

Setting
Provincial base with limited exit routes and seasonal road constraints.
Trigger
Front-line movement and route closures over a seventy-two-hour period.
Decisions required
  • What indicators trigger hibernation, relocation or withdrawal.
  • Which functions continue remotely and which stop entirely.
  • How assets, data and partner obligations are handled before departure.
Incident and threat analysisCrisis and resilience advisorySecurity-management cycle