Safety and emergency preparedness: closing the gap between policy and practice

What does it take to create a truly proactive approach to safety, one that protects the organisation and drives value?  Explore how any organisation can harness the power of ‘chronic unease’ to improve emergency preparedness and embed a robust safety culture. 

A proactive safety culture is hard to build and harder to keep. As Patrick Hudson observed, ‘Once significant improvements in outcome performance have been achieved, management take their eyes off the ball.’ His ‘Safety Culture Maturity Model’ has shaped how organisations think about safety for decades because it exposes a problem every HSEQ professional recognises: progress that quietly reverses the moment it stops being actively maintained.

Today, the gap remains the same. Industry assessments suggest that ‘most organisations with functioning safety management systems sit at the calculative level — systems in place, data collected, compliance met. Most aspire to be proactive.

Few reach generative’ (Cairn Risk, 2025; SmartQHSE, 2026). Likewise the Safe365 Safety Culture Maturity Report (2024) found that reactive practices dominate over proactive ones across industries. While policies and incident reporting score around 70%, proactive factors such as internal auditing and emergency stress testing scored below 40%.

Challenges land from many directions:

• Leadership that supports preparedness in principle but rarely prioritises it in practice. 
• Staff turnover erodes what has been carefully built. 
• Cross-functional teams — legal, communications, IT — disengage between incidents.
• Exercises meet the annual requirement but do not build real capability. 

There’s also the persistent challenge of demonstrating readiness to people who will only discover its value when something goes wrong.

So what can you do to move from policy to practice? To shift from a reactive to a sustainable, proactive health and safety culture? 

The trifecta: how to build a safety culture

One of the best ways to defend safety is to adopt an attitude of ‘chronic unease’ or vigilance.  Research on risk bears this out: ‘Chronic unease involves maintaining a state of constant wariness towards risk management, dismissing the notion that just because safety incidents haven’t occurred, they never will.’ Knowing that even minor risks can escalate into full-blown incidents is the key to developing a proactive culture that is risk-aware on a daily basis and ready to respond.

While HSEQ leaders must maintain this vigilance, organisations cannot operate in a constant state of unease. The challenge is translating that mindset into repeatable practices that embed preparedness across the organisation. To achieve this, three interlocking requirements must be achieved and maintained. 

1. Leadership genuinely owns preparedness 

This goes beyond approving a plan to participation, being accountable, and keeping it on the agenda even when nothing is going wrong. 

2. People practice regularly under realistic conditions

Frequently enough that capability does not decay. Exercises are realistic enough that what gets practised informs the response and actions taken during a live event. 

3. Reporting and review cycles ensure that plans are updated to act on insights

This is how identified improvements become actionable and transform culture. 

Take any one away, or let any aspect falter, and a gap opens.

1. Leadership Ownership: The Foundation of a Safety Culture

Research consistently identifies visible executive engagement as one of the strongest predictors of a positive safety culture. Organisations where senior leaders actively participate in safety activities, allocate resources, and maintain accountability for preparedness generally achieve more sustainable improvements than organisations where safety is treated primarily as a functional responsibility.  

This gap between the operational and strategic levels of safety matters acutely. As Rune Bratland, Head of Emergency Preparedness at Eviny, put it at the NSR webinar hosted by RAYVN in May 2026: ‘At operational level there is a notch better cooperation than what we tend to manage at strategic level.’ Leadership often finds it hard to make time for health and safety, but the decision to do so tends to act as a tipping point in creating a proactive health and safety culture.  

In our era of high turnover, especially at the operational level, leadership needs to lean in to ensure the health and safety remain top of mind. Erik Skaara, Co-founder of RAYVN, notes that many companies come to him saying, ‘There is constant role rotation that means we drop down from the level we had reached, and we have to work to get back up when new personnel and new resources come into the organisation.’ In organisations with high turnover, strong leadership can make all the difference: to create visibility, drive training, and hold personnel accountable to health and safety standards. 

2. Exercises drive and embed preparedness

Training and exercise discipline is where the work of embedding gets done day to day. But there is a real risk of doing it badly. Research demonstrates: ‘Poorly designed or executed exercises can produce a false sense of security that leads to worse real-world performance than in organisations that did not exercise at all’ (Borodzicz & van Haperen, 2002). And training also demands frequency and repetition. For instance, skill-based capability for CPR training shows measurable deterioration within 30 days of training without reinforcement (Anderson et al., 2011). The question is not whether to exercise: it is whether the exercises being run are building and sustaining genuine capability.

There are tensions too when it comes to how exercises build preparedness. Stress-testing for failures is a way to diagnose issues and improve practices. Yet, confidence-building exercises are often underrated. ‘Training that focuses on stress-testing for failure can leave teams feeling unprepared and unsure,’ a senior Health and Safety leader reflected during a recent conversation about exercise design. Exercises designed primarily to expose weakness can be counterproductive — when people repeatedly fail, it triggers defensiveness, erodes teamwork, and leaves participants feeling incapable of working independently and together. 

People do not build operational confidence by repeatedly being shown how they fail. Effective exercises build momentum: start with scenarios that allow participants to succeed, progressively increase complexity, and frame shortfalls as learning rather than failure. What gets built is the confidence to act decisively when something real happens.

So here is the conundrum: exercises drive and embed preparedness through stress-testing for failures, but equally it’s important to foster confidence among team members so they can respond effectively and with confidence together in the moment. What’s the answer? 

Try a scaffolded approach to emergency preparedness training 

True proactivity requires a shift in how we define “success” in a drill. The goal of an exercise should never be to test if the people fail, but rather to discover where the system reaches its limits. To build robust team cohesion while maintaining a healthy preoccupation with failure, organisations might consider a scaffolded approach to training:

Phase 1: Build the Team Reflex (Low Stress, High Success): Start with baseline drills designed to build psychological safety, familiarity with tools like RAYVN, and smooth communication patterns. This builds the collective confidence that “we can handle things together.”

Phase 2: Stress-Test the Infrastructure (High Complexity, Low Blame): Once teamwork is secure, introduce complex, compounding scenarios. If the response slows down or a communication link breaks, the facilitator explicitly frames this not as a team failure, but as a system vulnerability exposed.

When teams realize that finding a flaw in a plan is a collective victory—a vulnerability caught before a real emergency—you achieve a generative culture. What gets built isn’t just the confidence that nothing will go wrong, but the collective trust that they can navigate chaos together.

How to Structure a Proactive Training Program 

Different exercise types serve different purposes: treating them as interchangeable can be counterproductive. 

• Tabletop exercises are decision-making tools: valuable for testing whether senior leaders can reason through a scenario and stress-test plans — and the wrong tool for testing whether coordination infrastructure works under pressure. 
• Functional exercises test specific teams and systems. 
• Short platform drills maintain the familiarity that prevents hesitation when an incident fires. 

A programme built around a single format leaves the others untested. The exercise taxonomy below maps each type to its purpose, appropriate frequency, and what it cannot replace.

Exercise types and their role in the preparedness cycle

	Tabletop exercise	Functional exercise	Platform drill
Purpose	Tests senior leadership decision-making and plan assumptions under a realistic scenario	Tests specific teams, systems, and coordination paths under operational conditions	Maintains platform familiarity and reduces hesitation across the response network
Who participates	Senior leaders and cross-functional representatives	Named response functions — communications, legal, HR, operations — relevant to the scenario	Any member of the response network; accessible to occasional responders
Appropriate frequency	Quarterly to annually	Two to four times per year	Monthly
What it proves	That leadership can make sound decisions and escalate appropriately under pressure	That coordination infrastructure works and roles are understood under realistic conditions	That responders can operate the system confidently when an incident fires
What it cannot replace	Operational exercises — decisions are tested, not systems or coordination	Platform drills — functional exercises are too infrequent to maintain familiarity alone	Tabletops or functional exercises — drills build habit, not strategic judgment

Getting the format and frequency right matters. And, as we have seen, knowledge decays without reinforcement. An annual exercise, however well designed, does not hold capability between events. The organisations that perform well when an incident occurs are the ones that have adopted best practices across all exercise types: varied in format, regular in cadence, and embedded in operational rhythms.

Combining collaborative and individual training with the organisation’s critical event management solution drives improvements. A monthly 30-45 minute session focused purely on using a critical event management solution such as RAYVN — logging, tasks, templates, notifications — builds the reflex that prevents hesitation when something real happens. Small measurable actions to build experience can make all the difference in creating ongoing, sustainable preparedness. But training as a team to deliver a collaborative response is absolutely necessary for the moment when a crisis strikes (Roud et al., 2021).  

3. Reporting and Review: Turning Preparedness Into Proof

Creating time-stamped logs and reports is essential — for regulatory purposes, for post-incident review, for demonstrating readiness to leadership, insurers, and auditors. It is also the HSEQ Manager’s primary tool for making the case to senior leadership. A board-readable record of exercises completed, gaps identified, and actions closed turns preparedness into a demonstrated capability. 

During periods between incidents, safety can wane. Contacts change. People leave. Templates go stale. No one notices, because no one is actively using the system. The Financial Conduct Authority’s Operational Resilience Insights highlighted examples where firms had documented plans but had not adequately tested them in practice: limiting confidence that they would effectively mitigate harm during a real incident (FCA Operational Resilience Insights, March 2026). This is why training matters; but equally too it is important to document fully the training sessions and to assess and adapt as needed. 

But the circulation of documents alone is not enough. Training reports need to inform strategic decision-making. For the HSEQ manager and leadership, it’s important to create review practices that drive actionable plans and measurable improvements.  

Best practices: ways to build a proactive safety culture

The organisations that have made that transition from a compliance-driven to genuinely embedded health and safety culture embrace an ongoing, interlocking cycle of planning, preparedness and reviews to adapt and assess protocols, policies, and best practices. In other words, they find ways to operationalise ‘chronic unease’ to create a more proactive culture. 

Working with customers, RAYVN has found that these best practices can make a significant difference. And just as excellent physical fitness depends on regular exercises and training, with ongoing reviews to improve performance and level up, here are some ways to get started and build a practice. 

• Keep it simple and build up. Start with a small number of dedicated specialists — log keepers, Crisis or Incident Management team leads — who develop deep platform knowledge and become internal champions. Broader capability follows, built through short, focused sessions rather than large exercises.
• Log everything, regardless of scale. The best-prepared organisations use RAYVN for every incident reported to the duty phone, however minor. This keeps the platform familiar through regular use and keeps contact data, roles, and templates current as a by-product. Organisations that only open RAYVN for major exercises consistently find stale data when they need it.
• Break the response team into functional units. Not every incident requires a full Crisis Management Team. Organising by function — communications, legal, HR, operations — means minor incidents go to the relevant team only. Legal and HR practice on a personnel incident. Communications on a media query. Cross-functional engagement stops depending on full mobilisations that rarely happen.
• Embed practice in existing rhythms. The most sustainable training attaches to something people already do. A duty officer handover conducted in RAYVN, with a short scenario built in, is a training event that costs almost nothing. Scheduled drills, high-risk maintenance windows, and business continuity reviews can serve the same function.
• Address operational users and executives differently. Operational users default to familiar tools under pressure because RAYVN hasn’t been part of their daily rhythm — regular, low-threshold use fixes this. Executives are committed but time-poor; they may touch the platform only in a serious incident, which is exactly when they should not be learning it. Quarterly tabletop exercises run through RAYVN — where the platform is the medium, not just where it gets documented afterwards — is what builds genuine executive readiness.

Technology can help. The right critical event management solution can play a role in overcoming gaps. When exercises run through the same system as live incidents — same mobilisation, same logs, same audit trail — gaps surface during drills rather than events. An escalation delay identified in an exercise becomes an action, immediately assigned and tracked to resolution. When post-incident reporting takes minutes rather than days, the HSEQ Manager’s time goes to the learning loop. When that record is automatic and board-readable, the case for continued investment can be made in leadership language — without reconstruction, without delay.

Culture is built by people, through practice, over time. What RAYVN provides is the software infrastructure that makes consistent practice easier to sustain as well as deliver the evidence to assess and adapt for ongoing vigilance and continuous improvements.

Because an HSEQ culture isn’t a policy. It’s a practice.

If you’re working through how to design and implement a preparedness programme that genuinely embeds across your organisation — RAYVN’s Go Live Services team works directly with customers on exactly this. Get in touch to start the conversation.

Cyber resilience self-assessment

Just how resilient are you? Answer these eight questions to get a quick take on where your organisation stands.

Question 1 of 8 1 / 8

Back Next