Emergency Operations Safety Program

This program is the written, auditable system for keeping members alive and uninjured at emergency incidents, with structural firefighting as its core case. It sets how the department manages risk at every incident, how command is established and run, how every member is accounted for from arrival to release, how a member in trouble is found and brought out, and how the evidence on fire behaviour and building failure is turned into the way crews work. When this program is working, every incident has one incident commander who has done or received a 360-degree size-up and declared a strategy before anyone enters a hazard zone; every member inside a hazard zone is on the accountability board, in a crew, with a radio, and knows their air; a rapid intervention crew is standing by at every working fire with nothing else to do; a member who calls a mayday is heard on the first call and reached within minutes; a crew that is losing the building leaves before the building tells them to; and every working fire ends with a short, honest look at what happened that feeds the next one. The department can show all of that with records, not just with the fact that nobody has died lately.

Module switch: Required for every department that performs structural firefighting. The incident management, accountability, incident safety officer and rehab elements apply to every incident type and to training; the two-in/two-out, rapid intervention, mayday, air management and building-reading elements apply wherever members enter an atmosphere that is immediately dangerous to life or health (IDLH) or potentially so.

Profile Worksheet question answered: 01 Program Profile Worksheet Part C, module 9 (Emergency Operations Safety). The program also draws on the Part D baseline facts for mayday events, RIT deployments and near misses.

• Accountability officer: the member assigned by command to maintain the record of every crew’s location and assignment at an incident.
• Collapse zone: the area around a structure, set by the incident commander or the incident safety officer, within which no member or apparatus is positioned because the structure may fall into it (NFPA 1550, 2024, s. 10.7).
• Crew integrity: two or more members under one supervisor who enter, work and leave a hazard zone together and stay in contact by sight, touch or voice.
• Flow path: the route air takes into a fire and hot gases take out of it; crews between the fire and an exhaust opening are in the path (NFPA 1700, 2021).
• Hazard control zone: an area at an incident with a defined level of hazard and a defined control on who enters it (NFPA 1550, 2024, s. 10.7).
• IDLH: an atmosphere immediately dangerous to life or health; any interior fire atmosphere, including overhaul, is treated as IDLH until monitoring shows otherwise (NFPA 1550, 2024, s. 9.11.7).
• Incident commander (IC): the one person with overall authority for managing the incident (NFPA 1550, 2024, s. 18.3).
• Incident safety officer (ISO): the member assigned at an incident to monitor conditions and operations, with authority to stop, alter or suspend an imminently dangerous activity (NFPA 1550, 2024, ch. 5).
• Initial rapid intervention crew (IRIC): two members of the initial attack crew, outside the IDLH, trained and equipped and assigned for rapid deployment to rescue the entry crew; the “two out” of two-in/two-out (NFPA 1550, 2024, s. 3.3.140.1).
• Mayday: the radio call a member makes when lost, trapped, injured or otherwise in danger inside a hazard zone.
• Personnel accountability report (PAR): a roll call in which each crew supervisor confirms to command that every member is present and accounted for.
• Psychological safety: the shared belief in a crew or a department that it is safe to speak up, ask, admit an error and challenge a decision without being punished or humiliated (Edmondson, 1999)DOI.
• Rapid intervention crew (RIC or RIT): a crew of at least one officer and three members, outside the IDLH, dedicated to the rescue of members in trouble (NFPA 1550, 2024, s. 3.3.140).
• Survivability profile: the incident commander’s judgment, from fire conditions, time, construction and occupancy, of whether an occupant in a given space could still be alive.
• Work-as-done: how a task is actually performed under real conditions, as opposed to work-as-imagined in a procedure (Hollnagel, 2014).

R = responsible, A = accountable (one per row), C = consulted, I = informed.

The full generic duties of each role are in 01 Roles and Responsibilities; the team structure is in 06 Program Improvement Teams.

Each element states the requirement, the minimum method, the evidence, and the stage.

Requirement. Every decision to commit members to a hazard zone is a risk decision made by the incident commander against the department’s written risk principles, and it is revisited as conditions change (NFPA 1550, 2024, ch. 10).

The principles (adopt as written). These restate, in the department’s voice, the risk principles in NFPA 1550 and the acceptability-of-risk position of the IAFC Rules of Engagement (NFPA 1550, 2024, ch. 10; IAFC, 2010).

1. The department will risk a lot, in a calculated and controlled way, to save a life that can be saved.
2. The department will risk a little to save property that can be saved, and only with the controls in this program in place.
3. The department will risk nothing to save lives or property that are already lost.
4. No interior offensive operation in an abandoned or derelict building, or in a building where the fire is well advanced, unless there is credible, specific information that a savable life is inside.
5. When the resources on scene cannot support and protect the members inside, the strategy is defensive until they can.

Survivability profiling. Before committing a crew to a search, the incident commander and the company officer ask: given the fire’s location, the time it has been burning, the smoke conditions at the openings, the construction and the occupancy, could a person in that space still be alive? Search aggressively where the answer is yes or unknown. Where the answer is clearly no, do not send members in for a body. Record the reasoning in the tactical worksheet (toolkit item 5); a line is enough.

Strategy declared. The incident commander declares offensive, defensive or transitional on the tactical channel after the size-up, and declares every change. Crews do not enter until they hear a strategy.

Minimum method. The principles and the survivability questions are printed on the tactical worksheet and the ISO card. Officers rehearse them in command simulations at least annually. The ISO challenges the strategy when the principles and the actions on the ground do not match.

Evidence. Tactical worksheet or command log for every working fire showing strategy and time; ISO report; post-incident analysis. Stage: S1.

Requirement. An incident management system compatible with ICS Canada is used at every incident, from a single-company call to a multi-agency event, and command is held by one identified person at all times (NFPA 1550, 2024, ch. 10 and s. 18.3).

Minimum method.

• The first-arriving officer establishes command on the radio with a short initial report (unit, location, what is showing, strategy, command name) and either stays in command or passes it to the next-arriving officer under a stated procedure. An officer who stays in command does not also go inside; a “fast attack” with a working crew is a department decision for low-risk, two-person-crew incidents only, and ends the moment a second unit arrives. The first-arriving officer who engages in firefighting while nominally in command is a recurring finding in line-of-duty death investigations (NIOSH, 2003a, F2003-18).
• Command transfer is face to face or by radio with a situation report, a resource report and the accountability status, and is announced to all units.
• At a working fire, the incident commander has a command aide or an accountability officer by the time the first-alarm companies are working, and before a second alarm is struck.
• Divisions and groups are assigned where more than three companies are working or where crews are on more than one side or floor. Every crew knows its supervisor and every supervisor can name their crews.
• Staging is used once the first-alarm assignment is working; units arriving without an assignment stage and report, they do not self-assign.
• Unified command is used with police, EHS and other agencies where the incident has more than one lead agency. The host incident management system and accountability system govern every mutual aid company (section 5.17).
• The incident commander keeps a tactical worksheet (toolkit item 5) at every working incident; where the department has an aide or a command vehicle, the worksheet is kept there.

Evidence. Radio recordings and CAD timestamps for command establishment; tactical worksheets; command qualification records for officers. Stage: S1.

Requirement. A qualified incident safety officer is assigned at every incident or training evolution that meets a trigger, and has the authority to stop, alter or suspend any activity that presents an imminent hazard, reporting that action to the incident commander immediately (NFPA 1550, 2024, ch. 5).

Assignment triggers (adopt and adjust). The incident commander assigns, or dispatch automatically sends, an ISO at:

• any working structure fire (confirmed fire with crews inside or operating in a collapse zone);
• any second or greater alarm;
• any hazardous materials incident above the awareness level;
• any technical rescue (rope, confined space, trench, collapse, water, ice);
• any mayday, firefighter injury or near miss at an incident (the ISO is assigned if not already present, and begins the on-scene investigation);
• any incident lasting more than one hour with members in PPE;
• any live fire training and any high-hazard training evolution (the training safety officer role under Training Safety and Live Fire Program);
• any incident where the incident commander, a division supervisor or any member asks for one.

Until a qualified ISO arrives, the incident commander carries the safety function and says so on the radio. The ISO reports to the incident commander, not to a division, and wears a distinct identifier.

ISO authority and duties. Drawn from the ISO duties in NFPA 1550 (2024, ch. 5): monitor conditions, activities and operations; assess risk and advise the incident commander; establish and communicate hazard control zones including collapse zones; ensure rapid egress routes exist from any IDLH area; confirm PPE, accountability, RIT and rehab are in place; monitor the tactical and mayday channels; request assistant safety officers for large or complex incidents; ensure contaminated members, tools and PPE are processed through preliminary exposure reduction; begin the investigation of any injury, near miss or mayday within the incident area; document ISO actions; and hand over known hazards at demobilization. The ISO’s decision to stop an activity is not debated on the fireground; it is reviewed afterwards.

Minimum method. A qualified ISO pool large enough to cover every platoon and every district; the trigger card (toolkit item 1) on every command vehicle and chief’s vehicle; a written ISO report (see Form - Incident Safety Officer Report) for every assignment.

Evidence. ISO qualification records; CAD or command log showing the ISO assignment time against the trigger; ISO reports on file. Stage: S1 (triggers and pool), S2 (ISO report for every assignment, assistant ISOs).

Requirement. The department can state, at any moment during an incident, who is on scene, where each crew is, what it is doing, when it entered the hazard zone and how much air it had, and can confirm within minutes that every member is accounted for (NFPA 1550, 2024, ch. 10 and s. 21.5).

Minimum method.

• Hardware. A passport or tag system (one tag per member, held at the company level, lodged with the accountability board or entry control point) or an electronic system that does the same thing and still works when a battery or a network fails. The department standard is set in the toolkit (item 2). Tags or passports are carried on every apparatus and updated at the start of every shift or every response.
• Levels. Company officer accounts for the crew at all times (crew integrity, section 5.15). The accountability officer or command aide accounts for companies and their assignments. Entry control accounts for every member passing into an IDLH area.
• Entry control at IDLH. At every working fire and every hazmat or confined space entry, an entry control point is staffed at each entry point in use. Entry control records identity, crew, assignment, location, time of entry and air status at entry, and expected exit time, on the accountability board or Form - Personnel Accountability Report Log. A crew that enters by a different opening than the one where it was logged tells command.
• Accountability officer. Assigned at every working fire, as soon as the first-alarm companies are working, and before a second alarm is struck. May be the command aide at small incidents; is a separate member at a multi-division incident.
• Personnel accountability report (PAR). Command calls a PAR:
  • at a set interval of elapsed time from the first-arriving unit, department default every 20 minutes, with 15 minutes the shorter option for high-risk buildings (choose one in the Customize callout; common practice puts the interval at 15 to 20 minutes);
  • immediately on a mayday, a collapse, a flashover or backdraft, a change from offensive to defensive, an evacuation order, a report of a missing or unaccounted member, or any sudden event that could have trapped a crew;
  • on “fire under control” and before demobilization. Each PAR is logged with the time, the crews reporting and any crew not reporting. A crew that cannot be raised on two attempts is treated as missing and the mayday procedure (section 5.6) starts. A PAR is how at least one department discovered a member was missing after a collapse (NIOSH, 2003b, F2002-07).

Evidence. Accountability boards or electronic records retained with the incident record; PAR logs; drill records; audit observation at live incidents. Stage: S1.

Requirement. No member enters an IDLH atmosphere alone, and no crew enters an IDLH atmosphere at a structure fire until at least two trained and equipped members are outside, in contact with the entry crew, ready to go in for them. At every working fire, a dedicated rapid intervention crew is in place with nothing else to do (NFPA 1550, 2024, ss. 3.3.140, 3.3.140.1 and ch. 10).

Minimum method.

• Buddy rule. A member wearing SCBA inside a hazard zone is accompanied by another member similarly equipped with the same air capacity, and they stay within sight, touch or voice contact. In some jurisdictions this is a regulatory requirement as well as a program rule (J12 Fire Service OHS Rules and Fireground Operations).
• Initial rapid intervention crew (IRIC). Two members of the initial attack crew, outside the IDLH, in full PPE and SCBA, in radio contact with the entry crew and command, assigned to rapid deployment if the entry crew calls for help (NFPA 1550, 2024, s. 3.3.140.1). One of the two may be the pump operator, provided the operator can leave the panel without abandoning a charged line to a crew inside; the second must be free of any other duty. Where only three members are on scene, the entry waits for the fourth unless there is a known, specific rescue (the rescue exception, below).
• Dedicated rapid intervention crew (RIT). At least one officer and three members, trained to the rapid intervention crew requirements of the fire service training standard (NFPA 1400, 2026), positioned near the entry point with the equipment in toolkit item 3, assigned no other duty. The RIT monitors the tactical channel, walks the building exterior, softens the building (ladders to upper floors, forcing secondary doors, removing bars) and briefs command on egress routes. The department target is a full RIT in place within 10 minutes of the first interior entry, which matches the time at least one province sets by regulation for a rescue team (J12 Fire Service OHS Rules and Fireground Operations). Where the RIT cannot be in place in that time, the incident commander decides whether to continue the interior attack and reports it as in the next point.
• RIT not in place. If an interior attack continued without a RIT in place within the target, the incident commander completes a short written report to the fire chief within 24 hours (toolkit item 4 carries the fields), and the quarterly update counts it. This is a learning record, not a disciplinary one; the aim is to find out what the department needs so it happens less.
• Upgrade. When the RIT deploys, command immediately assigns a second RIT from the next-arriving company and requests an additional alarm. A deployed RIT is a working crew and comes off the board as a RIT.
• The rescue exception. The two-out requirement may be set aside only when a member sees a savable person who will die without immediate action. The officer reports it on the radio before entering, command gets a RIT or IRIC in place as the first priority, and the event is reviewed afterwards. The exception does not apply to property and does not apply to a search of a building with no sign of an occupant.
• Driver and pump operators. Driver and pump operators, the incident commander, the ISO, division supervisors and the accountability officer are not the RIT; check whether your jurisdiction’s rules or guidance say so expressly (J12 Fire Service OHS Rules and Fireground Operations).

Evidence. CAD and radio timestamps for RIT assignment against first entry; RIT equipment inspection records; “RIT not in place” reports and the quarterly tally; annual RIT drill records per member. Stage: S1.

Requirement. Every member knows when to call a mayday and how; every incident commander knows what to do when one is called; and the department practises both at least once a year (NFPA 1550, 2024, s. 18.3.1; NFPA 1400, 2026).

When to call. A member calls a mayday as soon as they think they are in danger, not when they are sure (IAFC, 2010). Triggers: lost or disoriented; trapped, pinned or entangled; fallen through a floor or roof; caught in a collapse, flashover or rapid fire progression; low on air or out of air without a known exit; SCBA failure; injured and unable to self-rescue; separated from the crew and unable to re-establish contact within a short time; any crew member missing. A company officer calls the mayday for a member who cannot.

How to call. Press the emergency button on the radio where fitted, then transmit “Mayday, mayday, mayday” and give LUNAR: Location (floor, side, room, nearest landmark), Unit, Name, Assignment and air, Resources needed. Activate the PASS alarm manually once the message is sent, then conserve air, find a wall, a window or a door, and keep transmitting at intervals. If the first call is not acknowledged, repeat it; do not change channels unless told to.

Radio discipline. On hearing “mayday”, every other unit stops transmitting. Command acknowledges the mayday, repeats the LUNAR back, and announces emergency traffic. The mayday stays on the channel it was called on; command moves all other fireground traffic to a second tactical channel if one is available and announces the change. Dispatch monitors the mayday channel, logs it and confirms the additional alarm.

Command actions, in order.

1. Acknowledge, repeat LUNAR, announce emergency traffic; assign a mayday channel and move other traffic.
2. Deploy the RIT to the member’s last known location; assign a second RIT; request at least one additional alarm and EHS at the advanced life support level.
3. Call a PAR to find out who else is missing.
4. Keep the fire attack going. Protecting the trapped member’s position with water, ventilation controlled to the member’s benefit and interior lighting is often what keeps them alive. Do not pull every crew out to look; command assigns who searches.
5. Assign a rescue group supervisor and, if not already present, an ISO. Stage EHS at the point of exit. Prepare for a second mayday.
6. Once the member is out: PAR, re-establish accountability, decide the strategy afresh, and arrange peer support and a defusing for the crews involved before they go home.

Fireground emergency traffic. “Emergency traffic” is the phrase for any urgent safety message that is not a mayday: imminent collapse, flashover warning, order to evacuate, a lost crew confirmed safe. Command announces it, everyone else clears the channel.

Evidence. Annual mayday and self-survival drill records for every operational member; incident records for every mayday; post-incident analysis for every mayday within 30 days; radio recordings. Stage: S1.

Requirement. Every member knows how much air they have, manages it as a working resource and begins exit from the IDLH area with enough air to get out before the low-air alarm activates. The low-air alarm is an emergency signal, not an exit cue (NFPA 1550, 2024, ch. 10; NFPA 1400, 2026).

Minimum method. The rule of air management is taught in recruit training and refreshed annually in the respiratory protection training cycle; crews check air at the entry control point, at each task change and at any sign of fatigue or disorientation; the company officer calls the exit for the crew on the lowest member’s air; work cycles in large or complex buildings are planned around air, not around the task. The full procedure, the cylinder management and the training content live in Respiratory Protection Program and SWP - SCBA Donning, Use and Air Management.

Evidence. Training records; entry control logs showing air at entry; near-miss reports involving low air; PIA findings. Stage: S1.

Requirement. No crew is committed to an interior position until the incident commander has completed, or received from an officer who completed it, a 360-degree view of the building and the fire, with the result stated on the radio. The absence of a 360 before interior attack is one of the most repeated findings in fatality investigations (NIOSH, n.d.-b, F2002-06; NIOSH, 2003a, F2003-18; IAFC, 2010).

Minimum method. The first-arriving officer walks or views all sides where the building and the site allow (where they do not, says so, and sends the second-arriving officer or the ISO to complete it). The 360 looks for: fire and smoke location, colour, volume, velocity and the openings that are feeding and venting it; basement windows and any sign of a below-grade fire; construction type and age, and any sign of lightweight engineered members; the number of storeys on each side; access and egress; occupants and reports of occupants; exposures; utilities; vehicles and signs of occupancy; collapse indicators; solar panels, battery storage and EV charging. The result is a short radio report: “360 complete, two-storey wood frame, fire first floor Charlie side, basement clear, offensive, Command is at Alpha.”

Evidence. Radio recordings; tactical worksheet entries; PIA. Stage: S1.

Requirement. Crews recognize the construction features and fire conditions that have killed firefighters, and the department gives them the building information before the fire.

Lightweight construction. Assume lightweight engineered construction (trusses, I-joists, metal gusset plates, engineered lumber) in any building built or renovated since engineered components came into common use, unless the department knows otherwise (MLITSD, n.d., GN 6-18). Unprotected engineered I-joist floors failed in research burns in about six minutes of direct fire exposure, against roughly 18 minutes for legacy dimensional lumber (UL, 2008). Once trusses or engineered members are known to be exposed to fire, crews come off and out from above and below them, and the strategy is reviewed. Sounding the floor and thermal imager readings do not tell you the strength of the floor (UL, 2008; MLITSD, n.d., GN 6-18).

Basement fires. Locate the fire before anyone goes above it. A 360, basement windows, a thermal imager from outside and a report from occupants are the tools. Nobody operates on the floor above an unlocated or uncontrolled basement fire; floors have collapsed into basement fires under crews who did not know the fire was below them (NIOSH, n.d.-b, F2002-06; NIOSH, n.d.-b, F2013-02). Attack from the exterior at basement level or from the basement entry where possible; control the flow path through the first floor.

Collapse indicators and zones. Indicators: cracks and bulges in masonry; walls out of plumb; sagging roof or floor lines; water or smoke pushing through walls; sounds of structural movement; heavy loads on the roof (HVAC, water, snow, solar); long fire exposure on unprotected steel or engineered members; a prolonged defensive fire in a lightweight building. The collapse zone for defensive operations is at least one and a half times the height of the wall, marked with tape or cones, with no personnel or apparatus inside it (MLITSD, n.d., GN 6-24). Corners are the safer positions; aerial streams are set up outside the zone. The ISO sets and announces collapse zones and keeps them clear (NFPA 1550, 2024, s. 10.7). Members have died inside the collapse zone of an exposure building nobody expected to fall (NIOSH, 2003b, F2002-07).

Vacant and abandoned buildings. The department keeps a register of known vacant and abandoned buildings (section 5.13), pushes it to dispatch and the mobile data terminals, and marks the buildings on the exterior with the scheme in toolkit item 6 where the municipality’s bylaw permits (MLITSD, n.d., GN 6-33). Interior operations in a vacant or abandoned building are defensive unless there is credible, specific information of a savable occupant (IAFC, 2010); where a crew does enter, a charged line goes with every crew, a thermal imager leads, and the ISO is on scene.

Evidence. Building construction refresher records; register and CAD flags; placards; PIA findings. Stage: S1 (rules), S2 (register and marking).

Requirement. The department’s attack and ventilation procedures are grounded in the research on modern fire behaviour and are revised when the research moves (NFPA 1700, 2021).

What the evidence says (adopt as the basis for tactical SOGs; cite the original research reports when training). The findings below are the Fire Safety Research Institute and NIST results that NFPA 1700 codifies (FSRI, n.d.-b; NFPA 1700, 2021; MLITSD, n.d., GN 6-6).

• Most fires in modern buildings are ventilation-limited by the time crews arrive. The fire is starved of air, not of fuel. Every opening crews make (a door forced, a window taken, a roof cut) gives it air.
• Fire behaviour is governed by the flow path: the route air takes in and hot gases take out. A crew between the fire and an exhaust opening is in the worst place to be. Size-up identifies intake, exhaust and where the entry point sits relative to both.
• Ventilation without water makes the fire worse, and quickly. The window between creating an opening in a ventilation-limited fire and flashover has been measured at well under two minutes in research burns. Ventilation is coordinated with water on the fire, never ahead of it.
• Water on the fire from the safest position, as early as possible, is the most effective tactic for improving conditions for occupants and crews. Large volume, applied to what is burning.
• Transitional attack (an exterior straight or solid stream through an opening to the ceiling before interior entry) did not push fire or steam onto occupants in the research, did not increase burn injury potential, and improved tenability. It is a legitimate opening move, followed quickly by interior attack and search; the speed of the transition matters.
• Door control (closing the door of the room of entry, keeping the entry door closed until the line is ready) isolates the crew from the flow path and buys time.
• Vertical ventilation is coordinated with the attack crew’s readiness, is done with the roof rules in SWP - Roof and Vertical Ventilation Operations, and never on a roof of exposed or unknown lightweight construction.

Minimum method. The department’s attack and ventilation SOGs (owned by the Fire Suppression and Emergency Operations team) state these points and the decision criteria; fire dynamics training is theoretical and practical and is refreshed annually; the team reviews the research at least annually and records any change.

Evidence. Dated SOGs with research citations; annual review record; training records. Stage: S2.

Requirement. A thermal imager is on every first-due suppression company, every member who may use one is trained to the thermal imager requirements of the fire service training standard, and the department teaches its limits as clearly as its uses (NFPA 1400, 2026).

Uses. Size-up (fire location from outside, basement fires through windows and grade-level openings), search, locating the seat of the fire, tracking flow path and gas layer movement, overhaul, checking victims, finding a downed member, monitoring battery and ESS temperatures.

Limits (teach these). It does not see through glass or water. It does not tell you the strength of a floor or a roof (MLITSD, n.d., GN 6-18). Temperature readings are not absolute and lag reality (NFPA 1400, 2026). It is one input; the crew still sounds, still watches, still keeps a wall and a hose line. A dead battery is a hazard; check it on every apparatus check.

Evidence. Inventory showing a TIC per first-due company; training records; apparatus check sheets with TIC function and battery. Stage: S1 (one per first-due company), S2 (training to the standard for every user).

Rehab is a condition of this program, not a courtesy. At every working fire and every incident or training where members have used two 30-minute cylinders or one 45- or 60-minute cylinder, worked about 40 minutes without a break, or worked in heat or cold, command establishes a rehab sector with medical monitoring, hydration, cooling or warming, and a release rule (NFPA 1580, 2025). The triggers, the monitoring thresholds set by the medical adviser, the cold-weather rules and the documentation are in Firefighter Rehabilitation Program and SWP - Rehabilitation at Incidents and Training. The ISO confirms rehab is in place; the accountability system tracks crews into and out of it.

Requirement. Crews have the hazard information about a building before they arrive at it (NFPA 1660, 2024).

Minimum method. Pre-incident plans for target hazards and high-risk occupancies, reviewed on a cycle; a lightweight-construction register fed by building permits (ask the municipality to send the fire department every permit for truss and engineered-lumber construction, or build the register from inspections) (MLITSD, n.d., GN 6-18); a vacant and abandoned building register with placarding (MLITSD, n.d., GN 6-33); CAD and mobile data terminal hazard flags for lightweight construction, vacant status, solar PV, battery storage, EV charging, hoarding, known violent occupants, hazardous processes; community risk assessment feeding all of it.

Evidence. Pre-plan coverage of target hazards; register counts and currency; CAD flag counts; crew interview (“tell me about the building at this address”). Stage: S2.

Requirement. When conditions inside exceed what the controls can manage, crews leave, and everyone knows the signal (MLITSD, n.d., GN 6-24).

Withdrawal triggers. Any collapse indicator in section 5.9; trusses or engineered members exposed to fire; rapid fire progression or flashover indicators; a change to defensive strategy; loss of water supply to the attack line; a lost or missing crew; a mayday where the IC orders withdrawal; ISO order; time on fire past the department’s benchmark for the construction type without progress.

The signal. Two signals, drilled and posted: radio (“Emergency traffic, all units evacuate the building”) repeated three times, followed by a PAR; and an audible signal from apparatus (the department standard is a series of repeated short air-horn blasts for a set duration; choose and post it in the Customize callout). Crews leaving on an evacuation order take their tools and hose lines where they can and leave them where they cannot, and report to the entry control point for the PAR. Evacuation means out of the building and out of the collapse zone, not just out of the fire room. A “withdraw” order, by contrast, is an orderly retreat with the lines; crews must know the difference and the words.

After withdrawal. PAR, strategy declared, collapse zones set, apparatus repositioned, exposures covered, rehab for the crews coming out. No re-entry without a new size-up and a new decision from command.

Evidence. Posted signal; drill records; PIA. Stage: S1.

Requirement. Members go in together, stay together and come out together (IAFC, 2010; MLITSD, n.d., GN 2-2). A crew is two or more members under one supervisor, in contact with each other by sight, touch or voice, on the same radio channel, with one member responsible for the crew’s air and exit.

Minimum method. Crew assignment at the start of the shift or on the apparatus; no member separates from the crew inside a hazard zone; a member who must leave (low air, equipment failure, injury) leaves with the crew, or the crew leaves together; a crew that loses a member calls it on the radio immediately and starts a search of the last known position while command deploys the RIT. Freelancing (working outside an assignment or without a crew) is corrected on the spot and reviewed afterwards for what made it seem necessary, including when the outcome was good.

Evidence. Entry control logs showing crews, not individuals; PIA; near-miss reports; audit observation. Stage: S1.

Any incident on or beside a roadway is a roadway incident first. Apparatus placement to block, high-visibility apparel, advance warning, traffic incident management training and the stop-work rule when a scene cannot be protected are in Apparatus, Driving and Roadway Operations Program and SWP - Roadway Incident Scene Blocking (NFPA 1550, 2024, ch. 11; NFPA 1091, 2024). The incident commander owns the roadway risk the way they own the fire risk, and the ISO checks it.

Requirement. Every company from another department, and every other agency working inside the fire department’s hazard zones, works within the host incident management system and the host accountability system, and the host department applies this program to them as if they were its own (NFPA 1550, 2024, chs. 17 to 21).

Minimum method. Mutual and automatic aid agreements state that the host IMS, accountability, RIT, mayday and rehab procedures govern; that aid companies report to staging or to the entry control point and lodge their passports or tags; that aid companies work under a host division supervisor; and that the radio channel plan and the mayday procedure are shared. Joint drills on accountability and mayday happen at least annually with the department’s principal aid partners. Where the department gives aid, its officers follow the host’s system and report any safety deficiency to their own chief afterwards. The agreement content is in Contractor and Mutual Aid Safety Program.

Evidence. Signed agreements with the safety clauses; joint drill records; PIA findings on mutual aid incidents. Stage: S1 (agreements), S2 (joint drills).

Requirement. Every working fire, every mayday, every RIT deployment, every injury and every near miss at an incident is reviewed, and what is learned reaches every station (NFPA 1550, 2024, s. 5.7 and ch. 6).

Minimum method. A hot debrief led by the company officer or incident commander before crews leave the scene or at the station (five questions: what was the plan, what happened, what went well, what did not, what will we do differently). A post-incident safety debrief card (toolkit item 7) completed by the ISO or the incident commander for every working fire. Triage of the event to the right tier under Incident Investigation and Learning Program within one business day: an after-action review for the ordinary working fire; a post-incident analysis for a mayday, a RIT deployment, a collapse close call, a lost-time injury or a RIT-not-in-place event; an independent learning review for a death, a critical injury or where independence is needed (The Human Factor, 2026a). Near misses on the fireground are reported through the near-miss system under the learning firewall; a near miss reported in good faith is never the basis for discipline. Findings go to the Fire Suppression and Emergency Operations team, which changes the SOG, the training or the equipment and tells the members.

Evidence. Debrief cards; triage log; PIA reports; change notices; near-miss counts. Stage: S1 (hot debrief and card), S2 (full tiers).

(a) Work-as-done. Before the team writes or changes any procedure in this program, it runs a learning-team session with the crews who do the work (see 06 Program Improvement Teams section 5) and describes: how command is actually established on a first-due engine with three members; where the tags really are at 0300 at a volunteer station; what the entry control point looks like when the second unit is six minutes out; how the officer really decides when to leave on air; what crews do when the RIT is the pump operator and a chief; how the 360 is skipped when the building backs onto a ravine; what the evacuation signal sounds like over a running pump. The procedure describes the task as it is done safely under those conditions, not the version that assumes a full assignment on scene at once (Hollnagel, 2014; Conklin, 2012).

(b) Capacity and margins. What makes fireground work go right most of the time is experienced officers who read the building and the smoke, crews who know each other, a second unit close behind the first, a dispatcher counting elapsed time, air left in the cylinder when the decision to leave is made, and a department that lets an officer hold outside without being second-guessed. What erodes it: short crews, long response distances, overnight calls after a working day, heat and cold, radios that drop in basements, a RIT that keeps getting pulled to work, and praise for the crew that “made the push”. The program protects capacity by staffing the RIT from automatic aid rather than hope, by naming the hold-outside decision as correct in writing, by sending an ISO automatically rather than on request, by planning work cycles on air, by linking rehab and fatigue limits, and by making the “RIT not in place” report a resourcing signal rather than a mark against the officer.

(c) Just culture. Errors, adaptations and workarounds on the fireground are treated as information about the conditions crews face. A missed PAR, a crew separated by a collapsed hallway, a freelanced search that found a victim, a 360 cut short, an entry before the RIT was in place: each is reviewed for what made sense at the time and what the system needs to change (Dekker, 2016; Reason, 1997). The learning firewall applies: nothing said in a debrief, learning team, after-action review or post-incident analysis is used for discipline. Conduct concerns (intentional harm, impairment, reckless disregard, criminal acts) go to a separate process run by different people, and the member is told which process they are in (Marx, 2001; The Human Factor, 2026a). A “RIT not in place” report, a near-miss report and a stop-work call are never the basis for discipline of the person who made them.

(d) Psychological safety. Any member can stop or challenge an operation by saying the hazard and the action on the radio or face to face: “Command, Engine 3, the roof is sagging on the Charlie side, we need everyone off.” The officer or incident commander acknowledges on the radio, acts (holds, withdraws, re-tasks) or explains in one sentence why not, and the call is reviewed afterwards for learning whatever the outcome. The incident commander asks the ISO and division supervisors for bad news every ten minutes and thanks the person who brings it. Leaders show reporting is safe by telling the story of the last stop-work call and what changed because of it, by recognizing the crew that held outside as publicly as the crew that made the rescue, and by answering every concern raised through the route in section 11 within 15 days with what was done. The department measures this with the psychological-safety indicator in section 10 (Edmondson, 1999)DOI.

(e) Learning link. This program feeds all three tiers under Incident Investigation and Learning Program (method in Manual 02 - The Three Tiers and Event Triage; The Human Factor, 2026a): Tier 1 After-Action Review for every working fire, multi-unit response and good catch; Tier 2 Post-Incident Analysis for a mayday, a RIT deployment, a collapse or flashover close call, a lost-time injury, or a RIT-not-in-place event; Tier 3 Independent Learning Review for a death or critical injury, or where independence is needed. The three AAR questions a crew asks after a working fire: What did the building and the smoke tell us, and when did we know? Where was the margin thinnest (air, RIT, accountability, the roof), and what would have taken it away? What would we tell the crew that gets this call next week?

Every drill and sign-off is recorded in {{Records system}} against the member. The training officer assigned to the team reports completion rates in the quarterly update.

• SWP - Accountability and Personnel Accountability Reports
• SWP - Two-In Two-Out and Rapid Intervention
• SWP - Mayday
• Shared with other programs and referenced here: SWP - SCBA Donning, Use and Air Management; SWP - Rehabilitation at Incidents and Training; SWP - Roof and Vertical Ventilation Operations; SWP - Roadway Incident Scene Blocking; SWP - On-Scene Preliminary Exposure Reduction; SWP - Downed Power Lines and Utility Emergencies.

The team also owns the department’s tactical SOGs for fire attack, ventilation, search, basement fires and defensive operations, which sit outside this package as departmental operating guidelines but must cite section 5.10.

• Form - Incident Safety Officer Report
• Form - Personnel Accountability Report Log
• Tactical worksheet (toolkit item 5); RIT equipment checklist (item 3); post-incident safety debrief card (item 7); quarterly indicator worksheet (item 8); training sign-off (item 9).
• Incident records in {{Records system}}: CAD times, radio recordings retained for the period in 05 Document Control and Records, command logs, accountability records, ISO reports, PIA reports, “RIT not in place” reports.
• Training and drill records per member.

The quarterly indicator worksheet (toolkit item 8) carries these by district and overall.

Loop test. A volunteer firefighter reports on Monday that the accountability tags on the tanker have not been updated since the roster changed and nobody at the fire could find them. By Tuesday the tags are updated as the interim control. By Wednesday the item is in the team’s action log and the Corrective Action Register as a P2 with the station officer as owner and a closure date 30 days out, the HSO has checked three other volunteer stations, and the firefighter has heard back. Within the month, a tag-update step is added to the volunteer station’s monthly check, a change notice goes to every station, and the item is closed with the HSO’s spot check as evidence and reported in the quarterly update.

Audited against Checklist - Emergency Operations Safety. The five questions an auditor asks first:

1. Show me the last ten working fires. For each, when was command established, when was the 360 reported, when was the ISO assigned, when was the RIT in place relative to first entry, and when were the PARs called? (Records, not recollection.)
2. Pick any member on this platoon. When did they last do a mayday drill, and can they tell me, right now, what LUNAR stands for and when they would call it?
3. Show me the last “RIT not in place” report and what the department did about it.
4. Show me the last post-incident analysis for a mayday, a collapse close call or a RIT deployment, the corrective actions it produced, and the change notice that went to the stations.
5. Show me the last concern a member raised about operations, when it was answered, and what the member was told. Then tell me the evacuation signal and when it was last drilled at a volunteer station.

Accreditation crosswalk. A department seeking or holding accreditation answers these criteria with this program’s records: the critical task analysis behind the staffing of entry crews, IRIC and RIT (CPSE, 2019, criterion 2C.4); the standardized incident command system in policy and training (5E.2); the annual program appraisal produced by the team (5E.3); risk management practice at emergency operations (11A.8); qualified ISO deployment to all risk events (11A.11); and personnel accountability at all risk events (11A.12). The 11th edition applies from 2027; map the numbers again when it issues.

This program answers the evidence in 05 Design Principles and Lessons Learned. In summary:

• The five factors the fire service has distilled from the structural-fire line-of-duty death investigations are an improper or absent risk assessment, a lack of incident command, a lack of personnel accountability, inadequate communications, and a lack of or failure to follow procedures (Fire Engineering, 2023, summarizing the NIOSH reports; NIOSH, n.d.-b; NIOSH, 2003b; NIOSH, 2003a). Sections 5.1, 5.2, 5.4, 5.6 and 5.15 are those five, written as positive requirements that are measured on routine incidents, not only after harm. Good luck reinforces bad habits; near misses get the same review as injuries.
• Floors have collapsed into basement fires under crews who did not know the fire was below them (NIOSH, n.d.-b, F2002-06; NIOSH, n.d.-b, F2013-02); roofs and floors of lightweight construction have failed with no warning while crews relied on sounding and a thermal imager (NIOSH, 2003a, F2003-18); crews have pulled ceilings and taken windows in ventilation-limited fires and been caught in the rapid fire progression that followed. Sections 5.8 to 5.10 are the controls.
• Members have died unnoticed because no PAR was called, because they were working alone, because the PASS was not armed, because the radio was not on the right channel, or because the mayday was not called until it was too late (NIOSH, 2003b, F2002-07). Sections 5.4 to 5.7 and the equipment table are the controls.
• Rapid intervention crews have been absent, assigned other work, or made up of the pump operator and the incident commander (MLITSD, n.d., GN 6-11). Section 5.5 is the control, and the “RIT not in place” report is the honesty mechanism.
• Defensive fires have killed members standing inside the collapse zone of a wall nobody expected to fall (NIOSH, 2003b, F2002-07), and training fires have killed students when there was no safety officer and no evacuation signal (NIOSH, n.d.-b, F2000-27). Sections 5.3, 5.9 and 5.14, and the training safety program, are the controls.
• Stress and overexertion, almost all of it cardiovascular, is the leading cause of on-duty death in the United States in every year on record except 2020 (USFA, 2025); the rehab link in section 5.12 and the medical program are the population-level controls.
• The recommendations in fatality investigations have changed little across sixteen years of analysis (Hard et al., 2019)DOI; what is missing is putting them into practice. This program is built so that the controls are owned by the line, measured every quarter and audited every year, because that is what the evidence says is missing.

Stage 1 (Foundation) is: the written risk principles and IMS policy adopted and taught; a tag or passport system on every apparatus with entry control at every working fire; PAR triggers written and drilled; two-in/two-out and the dedicated RIT requirement written, with the staffing method for each station type decided and the “RIT not in place” report in use; the mayday procedure written and every operational member drilled once; the ISO trigger card in every command vehicle and a qualified ISO pool able to cover every platoon; the evacuation signal chosen, posted and drilled; the rehab link live; the hot debrief and the debrief card in use; air management taught; a thermal imager on every first-due company; the concern route in section 11 announced to every member.

Stage 1 cost (people and money). The largest cost is officer time: a one-day command and accountability workshop for every officer and acting officer, and a half-day mayday and self-survival drill for every member (budget one training night per volunteer station). ISO qualification for a pool of 8 to 12 members (course cost per member, plus backfill where career). Tags, passports and boards for every apparatus and command vehicle (modest; electronic systems are a Stage 2 decision). RIT packs for every first-alarm RIT assignment if not already carried. Thermal imagers only where a first-due company lacks one. The program manager’s time, about four hours a month, plus the team’s time.

Stage 2 (Operating) adds the building intelligence registers and CAD flags, the full ISO report for every assignment, the fire dynamics and building construction refreshers on an annual cycle for every member, the learning tiers running to time, joint drills with aid partners, the culture survey item, and the indicators reported quarterly.

Stage 3 (Learning) adds trend analysis across years, published lessons to peers, the external review of the program, and the department’s own research contribution (field trials of accountability hardware, participation in fire dynamics training research).

This chapter relies on the following legal requirements, which differ by province and territory. Check your jurisdiction’s section on each topic page before adopting it.

Print on a card for every command and chief’s vehicle. Front:

INCIDENT SAFETY OFFICER: ASSIGN NOW IF ANY OF THESE
[ ] Working structure fire (crews inside, or operating in a collapse zone)
[ ] Second alarm or greater
[ ] Hazmat above awareness level
[ ] Technical rescue: rope, confined space, trench, collapse, water, ice
[ ] Mayday, firefighter injury or near miss at this incident
[ ] Incident over one hour with members in PPE
[ ] Live fire or high-hazard training evolution
[ ] Anyone asked for one
Until the ISO arrives: "Command has the safety function." Say it on the radio.
ISO reports to Command. ISO wears the vest. ISO can stop any activity.

Back:

ISO FIRST TEN MINUTES
[ ] Report to Command; get strategy, assignments, accountability status
[ ] 360 of the building: collapse indicators, flow path, construction, basement
[ ] Collapse zones set and announced; apparatus and crews outside them
[ ] Entry control staffed; board matches crews inside
[ ] RIT in place, equipped, no other duty; second RIT identified
[ ] Rehab set up or on the way; EHS on scene or staged
[ ] Radio: mayday channel, emergency traffic procedure known to all
[ ] Utilities controlled; roadway blocked; lighting up
[ ] PPE and SCBA on every member in the hazard zone; hoods up; PASS armed
[ ] Decon area identified for crews coming out
Then: walk, watch, listen, report to Command every 10 minutes. Ask for bad news.

Department standard (choose): tag system (one tag per member, lodged with the company passport), passport system (company passport with crew tags, lodged at entry control), or electronic (list product; state the fallback when it fails). Whichever is chosen, the board carries this layout:

PAR worksheet (the fields of Form - Personnel Accountability Report Log in short): incident number; PAR number; time; trigger (interval, mayday, collapse, flashover, strategy change, evacuation, missing member, under control, demobilization); each crew called, response (all accounted, not accounted, no response), time; missing crews and action taken; accountability officer (role); PAR complete time.

Checked by: role, date. Deficiencies to the RIT company officer and the Corrective Action Register.

Incident number and date; time of first interior entry; time the dedicated RIT was in place (or “not established”); reason (staffing, response time, aid company delayed, RIT reassigned, other); what the IC did (held the attack, continued with IRIC only, requested additional alarm, defensive); outcome; what would have made a RIT possible; incident commander (role); submitted to the fire chief within 24 hours; reviewed by the program manager and the JOHSC; corrective action number if any. This is a learning record under the learning firewall.

Front: building sketch box with sides A to D, fire location, entry points, flow path arrows, collapse zone marks, apparatus positions, hydrant. Side column:

SIZE-UP      Time arrived ___  360 done by ___ at ___  Basement: clear / fire / unknown
             Construction ___  Lightweight? Y / N / unknown  Vacant? Y / N
             Occupants: reported / none / unknown  Survivability: yes / unknown / no (why) ___
STRATEGY     Offensive / Defensive / Transitional  declared at ___  changed at ___
COMMAND      IC ___  transferred to ___ at ___  Aide ___  Accountability officer ___
ISO          Trigger met? Y / N  Assigned ___ at ___  Collapse zone set ___
ENTRY CTRL   Point(s) ___  Staffed by ___
RIT          IRIC ___ at ___  RIT (unit) ___ in place at ___  Second RIT ___
PAR          1 ___  2 ___  3 ___  4 ___  (interval ___ min)  Event PAR ___
AIR          Low-air reports ___  Work cycle ___
REHAB        Established ___ at ___  EHS on scene ___
UTILITIES    Electric ___  Gas ___  Solar/ESS/EV flag ___
ROADWAY      Blocked by ___  Hi-vis ___
MAYDAY       Called ___  Channel ___  RIT deployed ___  PAR ___  Resolved ___
WITHDRAWAL   Signal given ___  PAR complete ___  All out ___
CHALLENGES   Stop-work or challenge calls received ___  Action ___
DEBRIEF      Hot debrief done ___  Card completed ___  Triage tier ___

Back: assignment grid (unit, assignment, division, time, status), additional alarm times, mutual aid units with passports received.

For vacant and abandoned buildings, where the municipal bylaw permits exterior marking, and in the register and CAD in any case:

Marking is placed beside the main entrance, at least 300 mm square, in reflective material, dated by the inspector, and reviewed every 12 months or after any fire. The register records address, inspection date, mark, hazards found, owner contact where known, and the date pushed to CAD. Lightweight construction is also flagged in CAD from the permit feed regardless of occupancy.

One per working fire, completed by the ISO or the incident commander at the hot debrief. Fields: incident number; date; IC and ISO (roles); strategy and changes; was the 360 completed before entry; was command transferred cleanly; accountability (entry control staffed, PARs on time, any crew missed); RIT (in place by, deployed Y/N); mayday Y/N; air management (any low-air exits, any out-of-air); building (construction surprises, collapse indicators seen, basement fire); fire behaviour (rapid fire progression, flow path issues, ventilation timing); roadway and utilities; rehab (established, members evaluated, any transported); injuries, exposures and near misses (numbers; reports filed Y/N); stop-work or challenge calls made (count; what happened); decon done before leaving; three things that went well; three things to fix; triage tier recommended (AAR, PIA, independent review); submitted to the HSO and the program manager within 48 hours.

Prepared by the team lead within 15 days of quarter end; to the program manager, deputy chief, senior team and JOHSC.

Fire Safety Research Institute [FSRI]. (n.d.-b). Fire attack, search, ventilation and basement fire studies [Research summaries]. UL Research Institutes. https://fsri.org

National Institute for Occupational Safety and Health [NIOSH]. (n.d.-b). Fire Fighter Fatality Investigation and Prevention Program [Program website and investigation reports]. Centers for Disease Control and Prevention. https://www.cdc.gov/niosh/firefighters/fffipp/index.html

Ontario Ministry of Labour, Immigration, Training and Skills Development [MLITSD]. (n.d.). Firefighter guidance notes (Section 21 Advisory Committee; individual notes revised to 2026). https://www.ontario.ca/document/firefighter-guidance-notes