incident command board level crisis

Incident command runs the scene while the board controls corporate consequence.

7 min read

The seam

The incident-command system touches board crisis governance where scene objectives require corporate money, disclosure, risk acceptance or another reserved decision.

What you leave with

Let the first qualified responder establish command and require the incoming authority to receive the documented 9-element transfer briefing.
Connect the company through one empowered representative instead of allowing executives to issue instructions into the command chain.
Separate incident objectives and operational periods from corporate approvals, materiality and risk-acceptance decisions.
Record which board powers are delegated for the incident and which remain reserved under the governing corporate law.
Use the reasonable-investor total-mix test for disclosure materiality rather than an internal severity tier or invented percentage.
Preserve facts outside privilege even when qualifying legal communications about those facts are protected.

A solvent release and fire starts on your factory floor. The site supervisor sees vapour, stops nearby work and raises the alarm. Municipal responders are travelling. Directors are joining a call. Both systems have legitimate work, and each becomes dangerous when it starts doing the other’s.

The first failure usually sounds helpful. An executive calls the supervisor with a shutdown instruction. Another asks the fire officer to protect a production line. Counsel tells everyone to move facts into a privileged channel. You now have competing assignments, missing evidence and no reliable account of who decided what.

The failure has a record. A 2011 Deepwater Horizon staff paper found decision structures operating outside Unified Command during the 2010 response. Two response teams became report-to bodies instead of decision-making bodies, which left uncertainty about decisions. Your executive committee can produce the same defect from a conference line.

Let qualified command form before corporate hierarchy arrives. Delay leaves arriving resources to self-assign while headquarters discusses titles. Under 29 CFR 1910.120, a covered US hazardous-substance response uses a site-specific ICS, and the senior emergency response official becomes the person in charge. That official needs at least 24 hours of specified training when controlling responders beyond awareness level.

Your first qualified responder therefore establishes command, names the command post and records the initial position. For a short response within one operational period, ICS Form 201 may carry the situation, objectives, organization and resources without a full written IAP. Corporate seniority does not displace that office.

Transfer the office through a documented briefing. Arrival alone creates ambiguity because the outgoing commander may still receive reports. FEMA ICS-200 requires a complete briefing, face to face when possible, and communication of the effective date and time.

Require the incoming authority to receive all nine information groups: situation; objectives and priorities; current organization; assigned resources; ordered and en-route resources; facilities; communications; forecast and concerns; and Command and General Staff introductions. Retain the ICS Form 201 with the transfer record. Everyone then knows which decision became effective when.

Connect the company through one empowered representative. Several executive voices produce several command routes. A request from the chief executive still competes with an Operations assignment when it reaches a supervisor directly. The scene cannot reconcile corporate rank with operational safety while controlling a release.

Name one company representative and one alternate. Give that person a written authority schedule, a direct corporate decision route and access to the Liaison Officer. NIMS uses three conventional Command Staff officers and four General Staff sections. The representative fits the interface; it does not become an eighth staff office with its own Operations cell.

The representative must commit the funds and resources already delegated. EPA doctrine expects that authority from a responsible-party member of Unified Command. In a US pollution response under 40 CFR 300.135, federal, state and responsible-party functions meet while the federal OSC maintains authority. Company participation preserves each authority’s accountability.

Keep scene objectives separate from corporate consequence. A shared status board often merges decisions because both chains use the word priority. Command may set objectives to protect responders, stop migration and control the source. The board cannot safely choose the hose line or direct a contractor around Operations.

Command turns those objectives into assignments for an operational period, generally 12 to 24 hours under NIMS. Each period begins with an Operational Period Briefing. The Planning P then repeats if the incident continues. These clocks govern tactical work; they do not create a securities deadline or approve corporate risk.

Corporate organs decide matters that their law and documents assign to them. Those can include expenditure above delegated authority, suspension of the business, a public commitment, disclosure and acceptance of residual enterprise risk. Finance may track time, procurement, compensation and claims, and cost through four conventional units. Tracking a commitment does not authorise it.

Build a request-and-decision route between the two cycles. Command states the operational need, latest decision time, consequences of refusal and available alternatives. The representative either acts under delegation or sends a decision packet to the named corporate owner. The answer returns as a constraint or resource commitment. It never returns as an executive assignment to field personnel.

The route also needs a missed-deadline rule. Command may choose another tactic when corporate approval does not arrive, provided that choice remains within command authority and available resources. Under US 29 CFR 1910.120, the safety official can alter, suspend or terminate activity presenting imminent danger. A delayed expenditure decision cannot hold that safety power open for headquarters.

Write the corporate authority before the call becomes crowded. Informal delegation fails when nobody can show its subject or limit. For a Delaware corporation, DGCL §§141–142 place business and affairs under board direction and assign officer duties through bylaws or resolutions. Section 141 permits committee delegation within the resolution and statutory limits.

Use an incident resolution with two schedules. The delegated schedule should identify who may commit resources, approve vendors, speak for the company and accept defined operational consequences. State its duration, reporting route and any conditions. The reserved schedule should capture matters retained by the board or another organ under the certificate, bylaws, statute and existing approvals.

Do not copy a Delaware schedule into another company. German AktG §§110–111, for example, assigns supervision to a supervisory board and bars transfer of management measures to it. Your governing law, constitutive documents and listing rules decide the corporate side of the interface. The incident structure decides the scene side.

Test disclosure through the investor’s information set. Internal severity tiers fail because they were built for response mobilisation. They do not answer the legal question. In the United States, TSC Industries asks whether a reasonable investor would view the fact as significantly altering the total mix. Basic adds probability and anticipated magnitude for uncertain events.

Record the known facts, probability, magnitude, qualitative consequences and information already public. Do not insert an invented percentage. SAB 99 rejects exclusive reliance on a numerical threshold. For a material US cyber incident, Form 8-K Item 1.05 ordinarily runs four business days from the materiality determination, rather than from the first alarm.

Keep facts available when counsel becomes involved. Moving the incident log into a legal channel damages command and still does not privilege the facts. Responders need observations, samples, photographs, assignments and times. Directors need the same factual base to oversee the response and make corporate decisions.

The US Supreme Court’s 1981 Upjohn decision protects qualifying communications, subject to purpose, confidentiality and governing law. It leaves underlying facts outside privilege. Maintain the operational fact log and source records. Keep requests for legal advice and counsel’s advice in a controlled legal record. Mark each accurately and preserve both.

Make the interface auditable at every operational period. A single representative can still become a bottleneck if authority and timing remain hidden. At each 12-to-24-hour planning cycle, reconcile open corporate requests with the IAP. Record the request, evidence, corporate owner, authority used, decision, rationale, time and route back to command.

That record lets directors show what information reached them and what action they assigned. In Delaware, Stone v. Ritter recognises two oversight routes: utter failure to establish a reporting system, or conscious failure to monitor one. A functioning interface supplies information. It also shows where command retained scene authority while the company accepted its own consequences.

Use a decision-log form people can complete during the event. JESIP Edition 3 requires the decision, rationale, action and owner, and date and time. Add the corporate authority used and the command recipient. Those fields expose a missing delegation before the next request reaches the representative.

When command demobilises, transfer continuing remediation, contracts, disclosure and investigation work into named corporate arrangements. Preserve the IAPs, transfer briefings, decision logs and source evidence. The scene closes through command. Corporate consequence continues through the organs already authorised to carry it.

Questions answered

Who establishes incident command before the public authority arrives?

The first qualified responder establishes command under the applicable plan and authority. For covered US hazardous-substance response, 29 CFR 1910.120 makes the senior emergency response official the person in charge of the site-specific Incident Command System.

What must a transfer-of-command briefing contain?

FEMA ICS-200 identifies nine information groups: situation; objectives and priorities; current organization; assigned resources; ordered and en-route resources; facilities; communications; forecast and concerns; and introductions to Command and General Staff. The effective date and time must also be communicated.

Does an arriving senior executive take command of an incident scene?

Corporate rank does not confer scene command. Scene authority follows the applicable law, response plan and incident-command structure; an executive exercises only a formally assigned incident role and the corporate authority attached to that role.

What is the corporate representative allowed to do in Unified Command?

The corporate representative may commit the resources and funds that the organization has validly delegated, communicate corporate constraints, supply technical facts and participate in joint objectives. Participation does not transfer another agency's regulatory authority.

Which decisions remain with incident command?

Incident command sets incident priorities and objectives, approves tactics and assignments, controls responder safety and resource accountability, and approves the incident action plan for the operational period. Corporate organs cannot create a parallel tactical chain.

Which decisions remain corporate during an incident?

Corporate decision owners retain matters assigned by company law and constitutive documents, including reserved expenditure, securities disclosure, business shutdown, contractual commitments and acceptance of residual enterprise risk. The exact allocation must be recorded for the governing jurisdiction.

Can a Delaware board delegate crisis decisions to a committee?

DGCL §141 permits a Delaware board committee to exercise powers stated in the resolution or bylaws, subject to statutory limits. The incident resolution should identify the delegated subject, duration, reporting route and decisions that remain reserved.

How long is an ICS operational period?

NIMS describes a planned operational period as generally lasting 12 to 24 hours. Command selects the actual period for incident conditions; it is a planning horizon rather than a corporate approval deadline.

How should a US issuer test whether incident information is material?

The federal test asks whether there is a substantial likelihood that the information would matter to a reasonable investor and significantly alter the total mix available. Probability, anticipated magnitude and qualitative consequences belong in the analysis; an internal severity tier or fixed percentage does not decide it.

When is a material cyber incident reported on Form 8-K?

Form 8-K Item 1.05 ordinarily requires filing within four business days after a US registrant determines that a cybersecurity incident is material. A specified Attorney General determination can permit an initial delay of up to 30 days.

Does legal privilege protect the facts gathered during an incident?

Under the US Supreme Court's 1981 Upjohn decision, privilege may protect qualifying confidential communications made for legal advice. It does not protect the underlying facts, so source records, witness knowledge and operational data must remain preserved and producible.

What records should the corporate-scene interface keep?

The interface should keep the command record, transfer briefing, incident action plans, fact log, request-and-decision log, corporate authority schedule and separate legal-communications record. Each corporate decision should show the request, evidence, decision owner, authority, rationale, time and route back to command.