Introduction

ISO 22320:2018 is an international guideline for incident management. It helps organisations prepare for, respond to, coordinate, and improve the way they handle incidents of any type and scale. In practical terms, it gives structure to how decisions are made, how information flows, how teams coordinate, and how response actions are controlled during emergencies, disruptions, and high-pressure events.

For many organisations, the real problem is not the lack of effort during an incident. The real problem is confusion. Roles are unclear. Escalation is delayed. Information comes from multiple sources. Contractors and departments respond differently. Documentation is incomplete. Recovery starts before the incident is fully controlled. Lessons are discussed, but not converted into corrective action.

That is where ISO 22320 becomes valuable.

It connects safety, emergency response, operational control, governance, communication, training, and continual improvement into one structured incident management approach. For organisations operating in India, the UAE, GCC markets, and global industrial environments, this matters even more because many sites face a combination of regulatory expectations, client audits, contractor interfaces, extreme weather exposure, complex supply chains, and high operational risk.

A fire, chemical spill, gas leak, medical emergency, electrocution, cyber disruption, logistics accident, marine event, public incident, or major plant upset can quickly become worse if command and control are weak. A disciplined incident management system helps reduce that risk.

What is ISO 22320:2018?

Incident management cycle flowchart showing stages detect, assess, escalate, command, coordinate, respond, recover, and review in emergency response process

ISO 22320:2018 is a guideline that helps organisations establish a structured incident management system to effectively manage emergencies and operational disruptions.

The standard focuses on three critical areas that ensure incidents are handled in a controlled and coordinated manner:

Command and control – defining who takes leadership and authority during an incident
Operational information – ensuring accurate information is collected, shared, and used for decision-making
Coordination and cooperation – enabling departments, contractors, and emergency responders to work together effectively

In a QHSE context, this standard helps organisations address key operational questions such as:

Who takes charge during an incident?
How is incident severity assessed?
What information is required for decision-making?
How do departments, contractors, and emergency responders coordinate their actions?
How are resources deployed and monitored during the response?
How are actions documented, reviewed, and improved after the incident?

ISO 22320 is not limited to public emergency agencies. It is highly relevant to private companies, industrial facilities, logistics operations, offices, hospitals, ports, utilities, projects, and other high-risk workplaces.

It also integrates naturally with broader resilience and compliance frameworks, especially where organisations already implement:

ISO 22301:2019 for business continuity
Emergency response plans
Emergency action plans
Risk assessment and hazard identification processes
Audit and compliance systems
Tabletop exercises and emergency drills
Incident investigation and lessons-learned processes

In simple terms, ISO 22320:2018 helps organisations move from reactive emergency response to a structured, repeatable, and auditable incident management system.

Who Is Responsible and Who Is Involved?

An effective incident management system does not belong to one department alone. It requires coordination between leadership, operations, safety, compliance, and frontline personnel. Each role in the organisation contributes to ensuring incidents are managed in a structured and controlled manner.

Employers and top management hold the overall accountability for the incident management framework. They are responsible for ensuring the organisation has clear expectations for emergency preparedness, defined authority levels, proper escalation structures, and adequate resources. Leadership also supports communication systems, reviews major incidents and trends, and ensures that lessons learned are integrated into governance, risk management, and business continuity planning. Without strong leadership commitment, incident management often remains a documented procedure rather than a functioning operational system.

HSE or QHSE managers and safety officers usually play the central role in designing and maintaining the incident management system. They coordinate risk assessment and hazard identification inputs, develop emergency preparedness plans, and establish incident response procedures. These professionals also organise training exercises, drills, and tabletop simulations to ensure teams understand their roles. In addition, they prepare compliance documentation, support audits, and conduct after-action reviews to ensure corrective actions are implemented and monitored.

Supervisors and line managers act as the first operational command layer during many incidents. They identify incident triggers, initiate escalation, and report events immediately. Their responsibilities also include controlling work areas, isolating hazards, accounting for personnel, coordinating workers and contractors, and communicating real-time information to the command structure. A well-designed incident management system ensures supervisors clearly understand these responsibilities before an emergency occurs.

Workers, contractors, and third parties also play a crucial role in the response system. They need to understand how to raise alarms, stop work when required, evacuate safely, report conditions from the field, and follow instructions from incident leadership. This is particularly important in industries such as construction, logistics, maritime, oil and gas, and large project environments across the UAE, GCC, and India, where multiple contractors and employers often operate on the same site.

Auditors, investigators, and compliance teams ensure that the incident management system is functioning effectively and remains aligned with compliance expectations. They review documentation control, incident logs, escalation matrices, exercise records, communication protocols, and evidence of lessons learned. They also verify that corrective actions are implemented and that management reviews are conducted to strengthen organisational resilience.

Role-Based View of Involvement

Role	Main Involvement
Top management	Accountability, resources, governance, review
QHSE manager	System design, training, audits, improvement
Safety officer	Site readiness, controls, response support
Supervisor / line manager	First-line command, escalation, field coordination
Workers	Reporting, response compliance, situational input
Contractors / third parties	Coordination, site-specific response participation
Auditors / investigators	Verification, evidence review, system improvement
Compliance teams	Legal, ISO, procedural, and record-keeping alignment

Key point: participation may be shared across many roles, but accountability and authority must always be clearly defined.

Why Organisations Need ISO 22320:2018

Organisations need incident management not because incidents are frequent, but because when incidents happen, weak coordination creates secondary failures.

1. It is relevant across many industries

ISO 22320 is not limited to one sector. It is useful in:

Construction – falls, fires, equipment incidents, contractor coordination
Manufacturing – machinery breakdown, chemical release, electrical incidents, evacuation
Logistics and warehousing – vehicle strikes, loading dock incidents, fire, supply chain disruption
Healthcare – patient surges, critical equipment failures, infection events, emergency communication
Oil and gas – gas leaks, process upsets, confined space rescue, multi-team emergency coordination
Maritime and ports – fire, collision, spill response, emergency communication, port security incidents
Utilities and power – outage events, electrical incidents, public safety risks
Offices and campuses – medical emergencies, fire alarms, security incidents, evacuation management
Mining and heavy industry – major accident hazards, rescue coordination, environmental exposure

2. It applies to both smes and large enterprises

ISO 22320 is relevant for organisations of all sizes. Smaller organisations may not have a dedicated command centre or emergency operations facility, but they still require clear role definitions, escalation thresholds, communication protocols, response procedures, and proper documentation of incidents and lessons learned. Larger enterprises need the same foundations, but with additional structure to manage multi-site coordination, integration with business continuity systems, contractor interfaces, public communication, supply chain continuity, and cross-functional command structures.

3. It supports both high-risk and lower-risk environments

While high-risk industries clearly benefit from structured incident management, lower-risk environments can also experience serious disruptions. Incidents such as fire, medical emergencies, security events, severe weather, public safety situations, IT or communication failures, and facility access issues can quickly escalate if not managed effectively. Even events that occur rarely can still have significant operational or safety consequences.

4. It responds to real compliance and audit drivers

Many organisations strengthen incident management systems due to external and internal compliance pressures. These may include legal obligations, client requirements, insurance expectations, internal governance standards, ISO alignment, audit findings, repeated weaknesses observed during emergency drills, or poor outcomes from incident investigations.

5. It improves resilience, not just response

A mature incident management system improves more than emergency response capability. It strengthens safety performance, emergency readiness, decision-making speed, communication discipline, contractor coordination, documentation quality, and corrective action effectiveness, while also increasing confidence during audits and management reviews. In reality, many organisations have emergency plans but lack a structured incident management system—ISO 22320 helps bridge that gap.

When Should It Be Implemented, Reviewed, or Updated?

ISO 22320 should not be treated as something activated only after an incident. It should be implemented before an event occurs and reviewed regularly.

When to implement it?

Organisations should establish or strengthen incident management when:

Starting a new site, project, plant, warehouse, hospital, or office
Entering a higher-risk activity or industry
Onboarding large contractor workforces
Preparing for client or certification audits
Introducing new equipment, hazardous processes, or logistics arrangements
Identifying major gaps in emergency preparedness
Expanding across regions, facilities, or countries

When to Review or Update the System?

An incident management system should be reviewed to ensure it remains effective and up to date. Reviews are typically required after incidents, drills or exercises, organisational changes, site layout modifications, regulatory or client requirement updates, audit findings, or when lessons learned reveal weaknesses. Regular reviews help ensure the system stays practical, compliant, and ready for real emergencies.

Suggested review triggers

Trigger	Why Review Is Needed?
Actual incident	Tests whether the system worked in reality
Drill or tabletop exercise	Reveals communication and coordination gaps
Audit or inspection	Identifies evidence and compliance weaknesses
Change in operations	May create new hazards, interfaces, or responsibilities
Seasonal risk period	May require different preparedness levels
Contractor or workforce changes	Affects competence, communication, and accountability

Regional and seasonal considerations

For India, UAE, and GCC operations, timing matters.

Examples include:

Extreme summer temperatures affecting emergency response, worker fatigue, and equipment reliability
Monsoon periods affecting logistics, flooding, electrical safety, and evacuation access
Dust storms or reduced visibility affecting transport and outdoor operations
High contractor turnover requiring repeated communication and role training
Ramadan or shift-pattern changes that may affect staffing and response readiness
Shutdowns, turnarounds, or project peaks where simultaneous work increases incident complexity

Best practice: review incident management capability before known high-risk periods, not after them.

Where Does ISO 22320 Apply?

Preparedness, response, and recovery resilience cycle diagram showing risk assessment, emergency planning, incident detection, command and control, restoration, and corrective actions.

ISO 22320 applies anywhere an organisation may require a structured and coordinated response to an incident. It is relevant across different workplaces, operational environments, and management systems.

Physical Locations

The framework can be applied in a wide range of workplaces, including:

Construction sites
Manufacturing plants
Warehouses
Offices
Logistics hubs
Hospitals and healthcare facilities
Ports and maritime operations
Laboratories
Utility and power stations
Public venues and campuses
Remote project sites

Operational Environments

Beyond physical locations, ISO 22320 also supports incident management across operational activities such as:

Supply chain operations
Contractor-managed work
Field service and maintenance activities
Transportation and fleet operations
Remote or distributed working environments
Control rooms and monitoring centres
Customer-facing environments
Multi-site organisations

System and Documentation Environments

Incident management is not only about responding on-site; it also involves structured documentation and information management. It integrates with systems such as:

Emergency response plans
Emergency action plans
Business continuity planning
Incident logs and escalation matrices
Status reporting systems
Audit and compliance records
Training documentation
Communication protocols
Digital dashboards and situational awareness tools

Together, these elements ensure organisations can manage incidents consistently, coordinate response actions effectively, and maintain clear records for learning, compliance, and continual improvement.

Where Dadisha fits naturally?

Organisations looking to strengthen their incident readiness can naturally connect this topic with resources available through Dadisha’s ecosystem, including:

QHSE training and CPD learning
Audit and compliance support
Incident management and emergency preparedness consulting
Digital risk and reporting solutions
Emergency response products, signage, communication tools, first-aid support items, spill response kits, and related workplace safety solutions

The key is to treat these as connected parts of one system, not isolated purchases or documents.

How to Implement ISO 22320:2018 in Practice?

Implementation should be practical and usable during real incidents. The objective is not to produce a large manual, but to create a system that people can apply quickly and effectively under pressure.

Step 1: Understand Your Incident Profile

Start with risk assessment and hazard identification to understand the types of incidents that could realistically occur.

Ask questions such as:

What incidents are most likely to occur at this site?
Which events could escalate quickly?
Which situations require external emergency services?
Where are the biggest coordination challenges?
What operational or business impacts could occur if the incident is not controlled quickly?

Typical scenarios to consider include fire, chemical spills, gas leaks, electrical shock, medical emergencies, confined space incidents, vehicle accidents, security breaches, cyber disruptions, severe weather events, contractor-related emergencies, and environmental releases.

Step 2: Define Command and Control

An incident response fails quickly if authority is unclear. Organisations must define who leads and who supports the response?.

Key elements include:

Incident commander or response leader
Response team roles and responsibilities
Safety officer responsibilities
Liaison roles for contractors and external responders
Communication leads
Decision-making hierarchy
Span of control and escalation levels

The structure should be clear, simple, and easy to apply during an actual incident.

Step 3: Build Operational Information Flow

Effective decisions depend on accurate and timely information. Organisations should define how incident information will be collected, shared, and updated.

This includes managing:

Incident notification procedures
Severity classification
Location and hazard information
Headcount and affected persons
Resource status
Control actions underway
Ongoing status updates
Shift handover during extended incidents

These elements support a common operating picture and stronger situational awareness.

Step 4: Establish Coordination and Cooperation

Incident response often involves multiple parties. Coordination arrangements should therefore be defined before an incident occurs.

Typical coordination partners include:

Contractors
Security teams
Facility management
Transport and logistics teams
Medical support providers
External emergency services
Regulators or local authorities
Clients and neighbouring facilities

Clear coordination ensures teams can work together efficiently during emergencies.

Tools and Solutions Supporting ISO 22320:2018 Incident Management

A structured incident management system is supported not only by procedures but also by technology, communication systems, and emergency response equipment.

Common solutions include:

Emergency notification systems
Incident management software
Crisis communication platforms
Mass notification tools
Radio communication systems
GIS / mapping dashboards
CCTV and monitoring systems
Lone worker devices
Gas detection systems
Fire detection systems
Public address systems
Command center displays
Access-control systems
Emergency lighting
Evacuation signage
First-aid kits and aeds
Spill response kits
PPE for emergency response
Training courses
Audits and compliance gap assessments

These tools help organisations improve situational awareness, communication, coordination, and response effectiveness during incidents.

Step 5: Document Core Procedures

A functioning system requires clear and controlled documentation. Important documents typically include:

Incident response plan
Emergency action plan
Escalation matrix
Role and responsibility matrix
Communication protocols
Site maps and assembly points
Emergency contact lists
Command structure guidance
Resource deployment procedures
Incident logging templates
After-action review formats

These documents help ensure consistency and traceability during incidents.

Step 6: Integrate with Business Continuity and Recovery

Incident management should connect with business continuity and operational recovery planning.

Key considerations include:

When recovery activities begin?
Who authorises operational restart?
How temporary controls are approved
How client, stakeholder, or regulator communication is handled?
How disruption impacts are assessed and prioritised?

This is where ISO 22320 incident management and ISO 22301 business continuity frameworks complement each other.

Step 7: Train People by Role

Training should be role-based, as different personnel have different responsibilities during incidents.

Typical training levels include:

Awareness training for all employees
Reporting and response training for workers
Escalation and coordination training for supervisors
Command and control training for leaders
Exercise leadership training for emergency coordinators
Evidence and review training for auditors and compliance teams

Training methods may include classroom sessions, CPD modules, scenario workshops, tabletop exercises, drills, simulations, and after-action review discussions.

Step 8: Test the System

A response procedure that has never been tested is only an assumption. Organisations should regularly test the system through:

Alarm drills
Communication tests
Evacuation exercises
Medical response scenarios
Contractor coordination drills
Command post exercises
Tabletop exercises for leadership teams

Testing should measure performance, not only completion. Useful indicators include:

Detection-to-notification time
Notification-to-command activation time
Response mobilisation time
Drill completion rates
Communication failure rates
Corrective action closure rates
Incident recurrence rates
Participation levels
Management review completion

Step 9: Review, Learn, and Improve

After incidents or exercises, organisations should conduct after-action reviews to evaluate the response and identify improvements.

Key review questions include:

What happened during the incident
What information was missing
Where communication failed
Whether escalation occurred on time
Whether resources were sufficient
Whether contractors understood their responsibilities
Whether records were properly maintained
What corrective actions are required

The goal is to convert lessons learned into system improvements, ensuring the incident management framework becomes stronger over time.

Common Mistakes to Avoid

Many organisations attempt to implement incident management but face challenges because the system is not structured or integrated properly. Several common weaknesses reduce the effectiveness of response and coordination during real incidents.

Typical problems include treating incident management as only an emergency response plan, unclear accountability during escalation, lack of a defined command structure, and poor coordination with contractors or external responders. Organisations may also rely too heavily on one experienced individual instead of a structured system. Other weaknesses include incomplete incident logs, weak status reporting, drills conducted only for compliance rather than learning, outdated contact lists and response maps, lack of documented evidence for auditors, and limited integration between safety, operations, and business continuity processes.

A more effective approach focuses on building a practical and structured system. Good practice includes:

Defining clear roles and responsibilities so everyone understands their function during incidents
Keeping procedures simple and usable during high-pressure situations
Testing the system under realistic conditions through drills and exercises
Conducting post-incident reviews to identify improvements and corrective actions
Connecting emergency response, recovery planning, compliance requirements, and training programs into one coordinated management framework

When these practices are followed, incident management becomes an operational capability rather than just a documented procedure.

ISO 22320 Incident Management Implementation Checklist

Use this practical checklist to quickly assess whether your organisation has the basic elements required for an ISO 22320–aligned incident management system.

Incident Management System Basic Check

Roles and authority clearly defined for incident command and response teams
Incident types and severity levels identified for different operational scenarios
Escalation matrix documented with clear reporting and decision levels
Communication protocols established for internal teams and external responders
Emergency contact lists reviewed and updated regularly
Contractor and third-party coordination arrangements defined
Incident logs and reporting templates available for structured documentation
Drills, exercises, and tabletop simulations scheduled to test preparedness
Lessons learned process defined to capture improvements after incidents or exercises
Corrective actions tracked and verified until closure
Management reviews conducted periodically to evaluate incident performance
Links established with business continuity and recovery plans

If several of these elements are weak, missing, or inconsistently applied, the organisation likely has emergency documentation but not a mature ISO 22320 incident management system.

ISO 22320 vs Related Systems

Topic	ISO 22320:2018	ISO 22301:2019	ICS / NIMS
Main focus	Incident management	Business continuity management	Operational command framework
Use during incidents	Strong	Indirect / linked	Strong
Use after disruption	Linked to recovery	Strong	Limited compared to continuity systems
Best value	Command, coordination, information	Continuity, recovery, resilience	Structured field response and command
Practical relationship	Works well with both	Complements incident management	Useful comparison for operational structure

This comparison helps organisations avoid confusion between incident response, continuity, and command frameworks.

Real Incident Case Study: Chemical Spill in a Manufacturing Plant

A chemical spill occurred in a manufacturing plant warehouse where industrial cleaning chemicals were stored. A forklift accidentally punctured a chemical drum, releasing hazardous liquid onto the floor. Workers nearby experienced irritation due to vapors, and the area had to be evacuated.

The organisation activated its incident management structure, isolated the area, deployed the emergency response team, and contained the spill before it spread to nearby drainage systems.

Incident Investigation Reveals

The internal investigation identified several system weaknesses:

Chemical drums were stored too close to forklift traffic routes
No physical protective barriers around hazardous material storage
Inadequate warehouse layout planning for forklift movement
Limited spill response training for workers
Emergency response procedures existed but communication during the initial minutes was unclear

These factors increased the likelihood of the incident and delayed early response actions.

5W1H Root Cause Analysis

1.What happened?
A forklift struck a chemical drum during routine material handling, causing a hazardous chemical spill inside the warehouse.

2.Where did it happen?
The incident occurred in the chemical storage area of the manufacturing facility warehouse.

3.When did it occur?
It happened during the morning shift while materials were being moved for production supply.

4.Who was involved?
The incident involved the forklift operator, nearby warehouse workers, the site safety officer, and the emergency response team that handled the spill.

5.Why did it happen?
The storage area was congested, protective barriers for chemical drums were not installed, and the forklift operator had limited visibility while reversing.

6.How did it happen?
While reversing the forklift, the operator accidentally struck an unsecured drum pallet, which caused the chemical container to rupture and release hazardous liquid onto the floor.

Recommended Actions to Prevent Re-Occurrence

To prevent similar incidents, the organisation implemented the following corrective actions:

1. Engineering Controls

Install protective barriers around chemical storage areas
Redesign warehouse layout to separate forklift traffic from hazardous storage
Improve lighting and visibility in storage zones

2. Administrative Controls

Update risk assessment and hazard identification for warehouse operations
Implement forklift traffic management plans
Introduce stricter chemical storage procedures

3. Training and Competence

Conduct spill response training for workers
Run chemical emergency tabletop exercises
Improve forklift safety training and awareness

4. Emergency Preparedness Improvements

Provide spill response kits and PPE in chemical storage zones
Strengthen incident communication protocols
Conduct regular emergency drills including chemical spill scenarios

5. Monitoring and Review

Track corrective actions through incident management reviews
Include spill response readiness in internal safety audits
Review emergency preparedness during management safety meetings

Conclusion

A structured ISO 22320:2018 incident management system allows organisations to respond to emergencies with clarity, coordination, and confidence. Instead of relying on ad-hoc reactions during critical situations, organisations gain a practical framework that defines command structures, communication channels, escalation processes, and operational coordination. This approach improves response effectiveness, strengthens safety performance, and ensures incidents are managed in a controlled and auditable manner.

Through its integrated QHSE ecosystem, Dadisha supports organisations in building practical incident management capability. This includes guidance on incident management frameworks, emergency preparedness documentation, escalation workflows, command and control structures, operational information management, and response coordination. Dadisha also strengthens organisational competence through QHSE training, CPD learning programs, incident management awareness modules, emergency drills, tabletop exercises, and role-based training for leaders, supervisors, and operational teams.

Beyond procedures and training, Dadisha helps organisations connect incident management with the wider QHSE environment. This includes workplace safety solutions, emergency preparedness tools, digital monitoring systems, risk management support, audit readiness, and compliance improvement initiatives. By integrating these elements, organisations can move beyond basic emergency planning and develop a resilient, audit-ready incident management system aligned with ISO 22320 principles.

If your organisation is looking to strengthen incident readiness, improve compliance confidence, and build a more resilient response framework, explore Dadisha’s QHSE services, training programs, marketplace solutions, and consulting support. A stronger incident management system today can protect people, operations, and reputation when it matters most.

ISO 22320:2018 Incident Management System: What It Is, Why It Matters, and How Organisations Can App