The Escalation Tree

An alert that reaches nobody is not an alert. The escalation tree is the part that decides whether anything happens.

When the escalation tree also depends on reliable work records, the official resource can support time, attendance and workload review without being treated as the emergency response itself. Compare any workflow with HSE lone-working guidance and keep alarm ownership, escalation and dispatch responsibilities explicit.

What it has to contain

First responder: name, role, number, and the hours they cover.

Second and third, with the same detail.

What each is authorised to do — call the police, send a colleague, enter a property, stand down the alert.

Timings: how long before moving to the next name.

And a final backstop that is never unavailable, which in practice means a monitoring service or a rota-based duty phone.

The out-of-hours problem

Most lone working happens outside office hours.

Most escalation trees are staffed during them.

Which means the tree has to be tested at the hours the work actually happens, not at eleven on a Tuesday morning.

A duty rota with a single phone that is always answered beats five names that are all asleep.

Keeping it current

Names leave. Numbers change. Roles move.

Review quarterly, and after every departure, which is a line in the leaver checklist and takes a minute.

Most trees examined after an incident contain at least one person who no longer works there, and that is the commonest single finding.

Authority, not just availability

A responder who can reach someone but cannot decide anything adds a step rather than a response.

State explicitly: this person may call emergency services without further approval.

Because hesitation about whether it is their call to make is the delay that appears in reviews, and it is removed by one sentence written in advance.

What the responder needs to hand

The worker's last known location and planned schedule.

Their vehicle and registration.

Their next of kin, and the rule about when to contact them.

Site access information: gate codes, key holders, who to ring at the client.

Any medical information the worker has agreed to share, held under its own rules and available at the moment it matters rather than in a file somebody has to find.

Testing it

Unannounced, at a realistic hour, quarterly.

Time each step.

Record what broke, and fix it before the next test.

A tree that has never been tested is a document rather than a control, and the difference only becomes apparent once.

Building it from the response backwards

Start from what needs to happen, not from who is senior.

Somebody needs to reach the worker, or send someone who can. That requires availability, a vehicle or a phone, and the authority to act.

Seniority is irrelevant to all three, which is why trees built from the management chart perform badly: the operations director is on the list because of their title and is at a conference in another country.

Build it from the duty rota outward, and include people whose job is to be reachable.

What each level should be able to do

First level: call the worker, call a colleague nearby, check the schedule, and call emergency services if the situation warrants it. That last authority belongs at the first level, not the third.

Second level: everything above, plus dispatch somebody, contact a client or key holder, and decide to enter premises.

Third level: the decisions with consequences — contacting next of kin, involving the police formally, standing down a search.

A tree where all three levels can only call the worker is three copies of the same step.

The stand-down decision

Somebody has to be able to say the alarm is resolved.

Who, and on what basis?

Because the failure mode here is an alarm that stays open while everyone assumes somebody else closed it, or one closed too early because the worker answered and sounded fine.

State the rule: an alarm is only stood down after voice contact with the worker, or after somebody has seen them.

Testing without disrupting

Announce that tests happen, never when.

Use a real alarm from a real device, not a message saying "this is a test", because the point is to find out what happens when the operator believes it is real.

Tell the responder afterwards, immediately, so nobody spends an hour on a search.

And time everything, because the timings are the output.

What the tests usually find

A number that rings out.

A responder who did not know they were on the list.

Hesitation about whether to call emergency services.

Nobody at all between eleven at night and six in the morning.

And an average time that is two to four times the office-hours figure, which is the finding that changes the arrangement.

Keeping it in one place

One tree, not one per department, per site or per supplier.

Two trees diverge within months and the divergence is discovered during an incident, when the monitoring centre calls a number that the internal list replaced a year ago.

Where a monitoring supplier holds a copy, agree how it is updated and confirm quarterly that theirs matches yours.

The document itself

One page, printable, and held somewhere reachable without a computer.

Because the person who needs it at two in the morning may be looking at a phone in a car park.

Laminated in the vehicle, pinned in the control room, and in whatever app the responders actually open.

A tree that exists only inside a system nobody can log into at night is not available at the moment it is needed.