For emergency management offices
No role in incident command, no life-safety decision, no place in a response-time loop — a dependency on an outside system during an activation is a failure mode with no backup, and it should be refused rather than engineered around. What can be carried is the preparedness backlog and the reimbursement documentation that consumes the office long after the event closed.
Between events the office is small, and the work is plans, exercises, training records, mutual aid agreements, grant applications, equipment inventories and a hazard analysis that should be revised and never is. All of it is due to somebody, none of it is urgent this week, and all of it is what an after-action report will say was inadequate.
During an event the office is the centre of everything and nothing else exists. That period is short, it is intensely human, and every hour of it will later have to be documented by people who were too busy living it to write it down.
Then the event ends for everybody else and begins for the emergency manager. Damage assessments, project worksheets, procurement documentation, force-account labour records, equipment usage logs, environmental and historic preservation reviews, appeals of a determination made by somebody who was not there. It runs for years, and it is done by the same two people, who are also preparing for the next one.
The reimbursement rules are unforgiving and the money is large. A missing timesheet, an undocumented equipment rate, a procurement that cannot demonstrate competition, a category assigned wrongly at the start — any of these can turn an obligated amount into a deobligation years later, after the jurisdiction has spent it.
And mutual aid multiplies the record-keeping. Resources arrive from jurisdictions with different tracking practices and different rate schedules, and reconciling that afterwards is a task nobody was assigned during the event because during the event there was a disaster.
Reimbursement depends on documentation produced contemporaneously with the response, and the response is precisely the period during which nobody in the office has capacity to produce documentation.
Every emergency manager knows this and none of them can solve it by trying harder, because the constraint is not effort. It is that the same small group is both operating the response and the only group who could record it.
So the useful intervention is entirely outside the response window, and it is in two places. Before: the structures that make contemporaneous capture possible at all — a documentation plan, agreed rate schedules, pre-positioned forms, a written category framework, mutual aid tracking conventions agreed with partners while there is time to agree them. After: the assembly, chasing and reconciliation that turns a pile of records into a defensible package.
The after-work is document work with written rules, and it is enormous. Matching timesheets to activation periods. Finding the equipment log that supports a claimed rate. Identifying which procurement files lack the competition documentation the rules require. Assembling the package a reviewer asks for. Chasing the mutual aid partner who has not sent their cost detail.
What never moves is anything inside an activation. No role in incident command, no resource allocation decision, no life-safety judgement, no evacuation or sheltering call, and no dependency that an activated operations centre would have to rely on. Those belong to trained people under a command structure, and a vendor in that loop is a risk without a mitigation.
Documentation gaps found early rather than at review — measured by count of missing support items identified within thirty days of closure versus at reviewer request.
Time to assemble a complete project package — measured by elapsed hours from a reviewer request to a complete package, timed on a real request.
Preparedness items that are actually current — measured by count of plans, exercises, training records and agreements past their own review date.
Mutual aid cost detail outstanding — measured by count and age of partner jurisdictions whose cost detail has not arrived.
Procurement files that cannot demonstrate what the rules require — measured by count of files missing competition documentation, found before a reviewer finds them.
Staff hours spent on recovery documentation between events — measured by time-on-task sampling across preparedness and recovery work, before and after.
Grant reporting deadlines met without a scramble — measured by days between a preparedness grant report becoming due and its submission.
any role in incident command, any resource allocation, any life-safety decision, any evacuation, sheltering or warning judgement, any damage-assessment determination, and any category or eligibility determination for reimbursement. Nothing here operates during an activation and no activated operations centre should depend on it. Those are the job of trained people under a command structure.
Records are read from and written back into what your jurisdiction already uses — your incident documentation system, your financial system, your payroll and timekeeping, your asset and equipment records. Nothing becomes a second authoritative record, because a second record of a cost is exactly what a reimbursement reviewer will find.
Rate schedules and the category framework come from your own adopted policy and the applicable programme rules. Where two of your own sources disagree, that is reported as a question for your office rather than resolved, because resolving it would be making a claim decision.
Nothing subscribes to, participates in, or depends on an operations centre during an activation. That is a deliberate architectural exclusion rather than a scope limit — the office should be able to run a full response with this arrangement completely offline and notice nothing.
Where an interface does not exist, that is stated as a limitation. Screen automation against a financial system that determines reimbursement is a bad idea for the same reason it is a bad idea against an eligibility system.
The reimbursement record is the artefact. Every action carries what was done, under which written grant, by which actor, at what time, against which project, with what result — produced during the work. When a determination is appealed years later, that record is the argument.
Jurisdiction data stays inside your tenancy, on your retention schedule, exportable by you. Disaster records are public records in most jurisdictions and are frequently litigated, so a vendor-held copy on a vendor clock is a problem waiting to be found.
The exclusion from the response loop is architectural. There is no configuration in which this participates in an activation, and that is stated here so that an office evaluating it does not have to establish it by asking.
On assurance: an independent SOC 2 Type II attestation is in progress and no report exists yet. Where a specific programme carries a safeguarding obligation, terms are agreed in writing during scoping.
The emergency manager’s question is whether anything could become load-bearing during an activation. The answer is no by construction: run a full response with this offline and the response is unaffected. If a proposal ever creates such a dependency, refuse it.
Finance will want to know that nothing touches an obligation or a payment. Nothing does. Reconciliation here means comparing two of your own numbers and reporting the difference to a person who decides.
The auditor should review the record format against a real reimbursement package before anything runs. If the record would not support an appeal, that is a reason to stop.
Counsel’s question is public records and litigation hold. Records stay in your systems on your schedule, and litigation-hold handling is scoped explicitly rather than assumed.
One closed event’s recovery documentation, or one quarter of preparedness obligations — assembled read-only, with no authority to contact a partner or touch a financial record.
Starting with a closed event is deliberate. There is no time pressure, no life-safety exposure, and the answer is checkable against what a reviewer already said. If the assembly finds gaps a reviewer did not, that is useful; if it finds none, the office learns its documentation is stronger than it feared.
The preparedness alternative is equally legitimate: one quarter of plans, exercises, training records and agreements, measured against their own review dates. Offices are usually surprised by that count and it is actionable without any delegation.
If it continues, the first grant covers one administrative act on recovery documentation, with the activation exclusion written into the scope document rather than assumed from this page.
Agreed completely, and that is why nothing here is in the room. The exclusion is architectural rather than a policy: there is no configuration in which this participates in an activation, and the correct test is to run a full exercise with it offline and confirm nothing changes. If a vendor proposes a role inside your response, the risk is not the vendor — it is that you have added a dependency with no redundancy to the one process where redundancy is the whole discipline.
They should not accept anything on the strength of who assembled it, and the design agrees: the package is your claim, argued by your office, supported by your records. What is assembled is the support — the timesheets matched to activation periods, the equipment logs behind a rate, the procurement files that do and do not show competition. If a reviewer disputes a figure, the record shows where it came from, which is a stronger position than the one most offices are in today.
That is exactly right and it is the honest limitation of this page. Nothing can create contemporaneous records for a response it is not part of. What can move is everything that makes contemporaneous capture possible before an event — agreed rate schedules, pre-positioned forms, a written category framework, tracking conventions agreed with mutual aid partners — and everything that recovers the record afterwards while people still remember. The gap during the activation remains a gap, and any vendor claiming otherwise is proposing the dependency you should refuse.
Then start with the smallest possible thing: one closed event, read-only, no delegation, no contact with anybody. That produces a gap list and an assembly time you can compare against your own experience, and it costs your office the time to hand over access and answer a few questions. If the finding is that your documentation is in good shape, you have spent very little and learned something worth knowing before the next event.
In your systems, on your retention schedule, exportable by you without a request to us — which is the only arrangement that survives a records request cleanly. Litigation-hold handling is scoped explicitly in the initial documents rather than discovered later. If your counsel is not satisfied that the record would be defensible and producible, that is a reason to stop before anything is delegated.