.svg)
.svg)
- OSHA requires a written emergency action plan for most workplaces
- Your plan must cover evacuation routes, alarm systems, and employee accountability
- Hybrid offices need variable-occupancy headcounts, not static rosters
- Drill frequency isn't regulated, but quarterly is the practical minimum
- Post-incident reviews are where most plans fail and most improvements happen
A workplace emergency plan is a written document that tells every person in your building what to do when something goes wrong. It's required by OSHA standard 29 CFR 1910.38 for any business that provides fire extinguishers or expects employees to evacuate during an emergency. If that describes your office, you need one. This guide walks through every element of a compliant plan, with specific guidance for hybrid and multi-site workplaces.
What a workplace emergency plan is and why it's non-negotiable
An emergency action plan (EAP) is a written document that organizes employer and employee actions during workplace emergencies. Fires, severe weather, chemical spills, active threats, power failures. The plan covers all of them.
The legal requirement is straightforward. If your workplace has fire extinguishers, or if anyone will evacuate during an emergency, OSHA mandates a written EAP. The only exception: employers with 10 or fewer employees can communicate the plan orally instead of writing it down. Even then, a written plan is smarter. Memory is unreliable during a crisis.
The business case goes beyond compliance. Over 2.5 million workplace injuries were reported by private-sector employers in 2024 alone. A well-developed plan won't prevent every incident, but it reduces severity, limits liability, and gives your people a clear path to safety. That's the whole point.
If you're building out broader workplace security policies, the EAP is the foundation. Everything else, access control, visitor protocols, threat response, layers on top of it.
OSHA Emergency action plan requirements: What the regulation actually says
Let's break down 29 CFR 1910.38 into plain language. The standard requires your plan to include these minimum elements:
1. Procedures for reporting fires and other emergencies. Who calls 911? Who activates the building alarm? Don't assume people know. Spell it out.
2. Procedures for emergency evacuation. This includes escape routes, exit assignments by area, and the type of evacuation (full building vs. partial floor). Your office space planning directly affects this; every layout change should trigger a route review.
3. Procedures for employees who remain behind. Some employees may need to shut down critical equipment, gas lines, or electrical systems before evacuating. Identify who they are and what they're responsible for.
4. Accounting for all employees after evacuation. You need a headcount method. Paper rosters, badge data, digital check-ins. Something reliable.
5. Rescue and medical duties. If any employees are assigned first-aid or rescue roles, name them and describe their responsibilities.
6. Names or job titles of contacts. Employees need to know who to call for more information about the plan or their specific duties.
7. An alarm system. The plan must describe how employees will be alerted. This can be a fire alarm, PA system, text alert, or combination.
Two additional requirements that people often miss:
- You must review the plan with every employee when they're first assigned to a job, when their responsibilities change, or when the plan itself changes.
- The plan must be kept in the workplace and available for employee review. If you have 10 or fewer employees, you can communicate it orally, but for everyone else, it needs to be written and accessible.
That's the regulatory floor. What follows is how to build a plan that actually works in a modern office.
Evacuation procedures for different office types
Generic evacuation plans assume a static building with the same people in the same seats every day. That hasn't been true for years. Here's how to tailor procedures to your actual setup.
Single-floor open offices
These are the simplest scenario. Two or more clearly marked exits, a single assembly point outside, and a floor warden who does the headcount. The main risk is complacency. Open layouts feel safe because you can see the exits. But during a real emergency, smoke, noise, and panic change everything.
Map primary and secondary exit routes. Post them at every entrance and in common areas. Assign a floor warden and a backup. Practice.
Multi-story buildings
Stairwell assignments matter here. Don't let everyone funnel into the same staircase. Assign floors or zones to specific stairwells, and make sure employees know which one is theirs. Elevators are off-limits during fires; say so explicitly in the plan.
If you're in a multi-tenant building, coordinate with your property manager and other tenants. Your evacuation can't conflict with theirs. Ask for the building's master emergency plan and align your procedures with it.
Hybrid workplaces with variable occupancy
This is where most plans fall apart. On any given day, your office might be 30% occupied or 80% occupied. A static roster won't tell you who's actually in the building.
You need real-time or near-real-time occupancy data. Desk booking systems, badge swipes, or visitor check-in logs all work. The point is that your floor warden shouldn't be guessing during a headcount. Gable's office management software tracks desk bookings and visitor check-ins in one place, which means your evacuation coordinator can pull a live occupancy list instead of working from a Monday morning roster on a Thursday afternoon.
Also account for visitors. Every guest in the building needs to be on someone's list. If your visitor management process doesn't capture who's on-site in real time, your post-evacuation headcount will have gaps.
Employees with disabilities or language barriers
OSHA specifically requires procedures for assisting people who need help evacuating. This includes employees and visitors with mobility impairments, visual or hearing impairments, or limited English proficiency.
Assign specific "buddies" for employees who need assistance. Pre-identify areas of rescue assistance in stairwells (most modern buildings have them). Translate critical signage and instructions into languages spoken by your workforce. Don't treat this as an afterthought; build it into the plan from the start.
Emergency plans are one piece of a broader security framework. This guide covers access control, data protection, and incident response policies that work alongside your EAP.
Read the guide
Emergency communication tree: Templates and protocols
A plan is only useful if people know about it in real time. Your communication tree defines who gets notified, in what order, and through which channels.
Build the tree in layers
Layer 1: Discovery. The person who discovers the emergency activates the alarm and calls 911 (or your local emergency number). They also notify the designated emergency coordinator.
Layer 2: Internal notification. The emergency coordinator notifies floor wardens, department leads, and the facilities team. This happens simultaneously, not sequentially.
Layer 3: All-hands alert. Floor wardens direct their zones to evacuate. A mass notification goes out via every available channel: building alarm, PA system, SMS, Slack or Teams, email.
Layer 4: External communication. A designated spokesperson handles communication with emergency responders, media (if applicable), and families. One voice. No freelancing.
Template: emergency contact chain
Here's a simple structure you can adapt:
Update this quarterly. People change roles, leave the company, switch phone numbers. A stale contact tree is almost worse than no tree at all.
Multi-channel notification
Don't rely on a single channel. Building alarms don't reach remote workers. Slack messages don't reach people who left their laptop at their desk. SMS doesn't reach people in a basement with no signal.
Use at least three channels simultaneously. For hybrid teams, make sure your notification system reaches people who are working from home that day. They need to know the office is in emergency mode, especially if they were planning to come in later. If you're thinking about how to communicate policy changes broadly, the same multi-channel principle applies to emergency alerts.
Post-incident reporting and investigation
Most organizations spend 90% of their emergency planning energy on the "before" and almost none on the "after." That's backwards. Post-incident reporting is where you find out whether your plan actually worked.
What to document immediately
Within 24 hours of any incident (or drill), capture:
- What happened. Timeline, trigger, type of emergency.
- What the plan said should happen. Reference the specific procedures.
- What actually happened. Where did reality diverge from the plan?
- Injuries or damage. Even minor ones. Document everything.
- Evacuation time. How long from alarm to full accountability?
- Headcount accuracy. Did you account for everyone? How long did it take?
- Communication effectiveness. Did every channel work? Did everyone receive the alert?
Root cause analysis
For actual incidents (not drills), conduct a simple root cause analysis. Ask "why" five times. Why did the incident happen? Why wasn't it caught earlier? Why did the response take longer than expected? Keep going until you hit something you can actually fix.
Corrective actions
Every post-incident report should end with specific, assigned corrective actions. "Improve communication" isn't a corrective action. "Install backup PA speakers in the east wing by March 15 and assign [Name] as owner" is.
OSHA's 29 CFR 1910.38(f) requires you to review and update the plan whenever employee responsibilities change, the building layout changes, or new equipment or materials introduce new hazards. Post-incident findings almost always trigger at least one of these conditions.
If you're managing compliance across your organization, tie your EAP review cycle into your broader compliance calendar so it doesn't slip through the cracks.
Gable Offices gives you real-time occupancy data, visitor logs, and desk booking, so your emergency coordinator always knows who's in the building.
Learn more
Annual drill cadence and training frequency
OSHA's guidance on drill frequency is surprisingly vague. The agency's evacuation planning publication says to hold practice drills "as often as necessary to keep employees prepared." No specific number. No mandated schedule.
That vagueness is a trap. Without a set cadence, drills get deprioritized until they don't happen at all. Here's a practical schedule for a typical office environment:
Recommended drill calendar
| Drill Type | Frequency | Format |
|---|---|---|
| Fire evacuation | Quarterly | Full building, timed |
| Severe weather shelter-in-place | Semi-annually | Full building |
| Active threat (lockdown) | Annually | Tabletop exercise + walkthrough |
| Medical emergency response | Annually | Scenario-based with first aid team |
| Communication system test | Monthly | Mass notification test (all channels) |
