The alert platform shows a completed send while replies stop arriving. A mobile network may be congested, a local gateway may be down, or the terminals may have lost service. Your accountability team now has linked failures to manage: the broken channel and the uncertain evidence for each person.
The distinction matters because a successful send can look like progress. In the FCC’s 2021 nationwide Wireless Emergency Alert test, 89.8% of 342 eligible completed survey responses reported receipt. Among 294 recipients, 32.0% reported a duplicate. Those figures describe message behaviour without establishing anyone’s welfare.
Freeze the account before changing the collection method. Channel failure creates pressure to rebuild the recipient list inside another tool. That move changes the population while changing the evidence source. You can no longer explain whether a missing reply arose from exclusion, failed delivery or silence.
Record the incident boundary, effective time, inclusion rule, responsible lead and every source version. Give each person a stable identifier and preserve duplicates as linked records. UK MSN 1794 shows the discipline in a bounded setting: for passenger voyages over 20 nautical miles, details are collected before departure and communicated within 15 minutes after departure. The maritime deadlines do not govern your workplace, but the versioned transaction remains useful.
Keep transmission evidence away from welfare evidence. A platform may record targeted, accepted by service, delivered and acknowledged. Each field answers a communications question, while a direct safe response, verified sighting or accepted transfer answers the welfare question.
Use separate linked logs with distinct claims and responsible owners. The transmission log records channel, message version, target, service event and time. The welfare record holds the response, identity check, source-event time, validation and status decision. CAP 1.2 uses five transaction codes: Alert, Update, Cancel, Ack and Error. Even an Ack records message receipt and acceptance without converting into a safe status.
Make every non-response an owned exception. Silence attracts interpretation when the queue has no structure. A person may lack coverage, have a dead terminal, miss the message, need assistance or be perfectly safe. Treating all these possibilities as harm wastes urgent capacity, while treating them as safety hides exposure.
Assign an owner, next action and review time to every person. Segment failed delivery, apparent delivery without reply, conflicting response, third-party report and plausible urgent need. Your ladder may try a stored alternate contact, a manager, a local accountability lead, an authorised presence source and then an emergency contact at the declared threshold. Record every attempt, its result and the time the next review becomes due.
Move through the communications ladder without moving the denominator. CISA’s 2024 PACE guidance describes four levels current as of 2023: Primary, Alternate, Contingency and Emergency. That order helps select another bearer, but gives no reason to open a fresh welfare poll with a smaller audience.
Carry the same person identifiers and unresolved queue into each level. Mark the channel used for each attempt and retain its service-event time. If a responder answers by radio after repeated failed mobile attempts, preserve every event. The evidence now explains both the delay and the eventual status.
NIST SP 800-53 Revision 5 places alternate telecommunications agreements in CP-8 and testing in CP-8(5) at an organisation-defined frequency. CP-8(3) also asks whether primary and alternate services have sufficient separation, even when one provider supplies both. Record the tested dependency, because different interface names can still share the failed gateway, power source or provider path.
Authorise the exact fallback transmission. Urgency creates the most dangerous shortcut here. A radio stored for emergencies can still be on the wrong frequency, outside its licensed radius or operated by an unauthorised person. A satellite footprint can cross a border while the uplink remains subject to national rules.
Check the terminal, frequency, service, power, antenna, mode, territory, equipment approval, responsible licensee and operator permission. In the United Kingdom, Simple UK Light permits 19 frequencies across four bands and caps effective radiated power at 5 W. Simple Site Light covers 1 km or less, so changing power, base-station use or footprint can change the permission.
Check the national route, not the label on the equipment. The ITU Radio Regulations, 2024 edition, provide the international allocation framework through WRC-23. National administrations still decide whether your actual transmission is permitted within their territory.
In the United States, 47 CFR Part 90 defines Public Safety Pool eligibility and names five 800 MHz mutual-aid channels. A corporate team cannot infer access from a programmed channel. Under 47 CFR Part 25, a satellite provider may hold blanket authority for user transceivers. You still need evidence that the particular unit and service are covered.
The control changes again at the border. A Canadian radio licence normally runs for one year and specifies apparatus, location or radius, frequencies and power. Australia has 17 class licences and six land-mobile options, with every technical condition still applying under a class route that needs no application or fee.
Treat terminal movement as a new legal question. A working terminal encourages teams to carry it to wherever the primary network failed. Possession and technical capability do not settle import, type approval, registration or location permission.
India’s 2026 rules require an overseas-registered satellite user terminal to be registered before operation. They bind a stationary fixed-satellite terminal to its approved premises within plus or minus 100 m. In the UAE, a satellite phone requires Type Approval and generally must connect through a UAE licensee or an effective roaming arrangement. Preserve the local approval, provider evidence and equipment identity with the activation record.
Reconcile evidence person by person. Aggregated reply totals conceal contradictions. A safe reply can arrive after a badge event suggests departure, while an itinerary can show a destination after a no-show. Copying the newest field over the older one destroys the sequence needed to judge both.
Order evidence by source-event time, then state what each source can prove. Annex I to EU Directive 2016/681 separates intended travel, itinerary, check-in, no-show, go-show and historical PNR changes. Use that distinction without borrowing the directive’s law-enforcement powers. A booking remains an intention, while a verified sighting answers presence at its own time.
Completeness and accuracy also need separate treatment. The UK Government Data Quality Framework defines six dimensions and illustrates 99.8% uniqueness with 500 real people represented in 501 records. A nearly unique list can still omit the person exposed to the incident. Keep duplicates linked, gaps declared and source limitations beside the total.
Where credible observations conflict, retain both and set a provisional status with an explanation and another check. Direct confirmation may displace an old itinerary. A badge event may still need corroboration because it proves a credential event rather than the holder’s present welfare.
Control every change to the population. Response rates improve quickly when difficult cases disappear from the denominator. That produces a cleaner dashboard and a false account.
Close a person shown outside the boundary as not affected, with the source and time. Add a newly discovered contractor with a reason and a new population version. Preserve the first list because it records the population used for the initial decision. In covered US workplaces, 29 CFR 1910.38 requires procedures to account for employees after evacuation. OSHA guidance also calls for the names and last known locations of missing workers to pass to the official in charge or emergency responders.
Close by evidence or accepted transfer. A weak process stops when the active queue becomes inconvenient. The Goodyear investigation shows the consequence. Employees were declared accounted for around 8:40 a.m., while contractor accounting ended and the emergency operations centre disbanded around 11:00 a.m. The victim was found around 1:20 p.m.
For each residual case, prepare the identity, incident relevance, last reliable observation, lawful assistance information, checks made, contradictions and callback. Record the recipient, disclosure and acceptance time. NTSB guidance describes the initial US aviation passenger list as the best available at the request time, even when names remain unverified, with periodic updates. That is a sound transfer pattern: preserve uncertainty, transfer ownership and keep corrections moving.
Your closing record states the original denominator, final status totals, population versions, unresolved transfers, source limits and corrections. Every included person finishes with sufficient evidence or an explicit recipient. The channel can fail without taking the accountability record with it.