A fire alarm, a burst pipe, a serious injury, a ransomware message on the screen. In the first minutes of any of these, the question is rarely "what is the perfect response?" It is "who do I call, and what is their number?" In a small company, the answer often lives in one person's phone, and that person is on holiday.
An emergency contact sheet fixes this. It is a single page that says who to call, in what order, and where the page is kept. It takes an afternoon to build. It is not a full continuity plan; for the larger question of keeping work going when a system is down, see a one-page business continuity plan. The contact sheet is the page you open first.
Decide what counts as an emergency
Keep the definition short, or people will hesitate. An emergency is anything that puts people at risk, stops the business from working, or exposes customer data or money. Examples:
- an injury, a medical event or a fire at the premises
- loss of power, internet or access to the building
- a suspected cyber incident, such as ransomware or a stolen laptop
- a payment or banking problem that blocks wages or supplier payments
- a legal or regulator contact you did not expect
If a person is unsure, the rule is simple: call the first name on the sheet and let them decide.
What goes on the page
Group the contacts so the right person is found in seconds. Four blocks cover most small companies.
1. People and safety. Local emergency services number, the first-aider or safety lead, and the owner or manager. Add the building manager or landlord if you rent. If you hold records of staff emergency contacts, say where they are, but do not copy personal numbers onto a page that many people can see.
2. Premises and utilities. The landlord or facilities contact, the electrician and plumber you actually use, and the utility fault lines. Note where the main switches and the water stopcock are.
3. Systems and data. Your IT provider or the person who administers the systems, the internet provider's fault line, and the supplier of your main business software. For a cyber incident, the National Cyber Security Centre's guidance for small businesses on response and recovery explains the first steps. If you do not yet have a tested backup, read a backup and restore test for a small company first.
4. Money and legal. Your bank's business support line, the insurance broker or insurer with the policy number, your accountant and, if you have one, a solicitor. Insurers often require quick notice of a claim, so the policy number and claim line belong on the page.
For each contact write four things: the name or role, the phone number, a second way to reach them, and what they are the right person for. A line such as "Alex, IT support, 07..., support desk, ransomware or lost laptop" is enough.
Set the order of calls
A sheet with thirty numbers and no order creates the same delay as no sheet. Give every event type a short call order:
- Safety first. If anyone may be hurt, call the emergency services before anything else.
- The owner or duty manager. One person who decides what happens next.
- The specialist for this event. IT for a cyber incident, the landlord for a building problem, the bank for a payment problem.
- Anyone who must be told. Staff, key customers, the insurer.
Write who decides when the owner cannot be reached. Every internal contact needs a named deputy with their own number. Without that, one absence stops the chain, which is the same weakness described in covering holidays and absence in a small team.
What to say on the call
Add a three-line script at the bottom of the page, so a stressed person does not have to improvise:
- Who I am and where I am.
- What happened and when I noticed.
- What I need from you, and the best number to call me back on.
Do the same for staff. Agree one person who speaks to customers and the press, so that people do not hear several versions.
Where it is kept
The most common mistake is storing the sheet only on the system that may fail. Use at least three places:
- Paper. One copy at the premises where people can find it, and one with the owner and the deputy at home.
- Offline. A copy on each manager's phone, saved so it opens without the internet.
- Outside the building. A copy with the accountant, the IT provider or in a separate cloud account that does not depend on your main login.
Write the date of the last check on the page. Keep passwords and access codes off it. For those, use a company password manager, and note on the sheet who can open it.
Keep it current
An old number is worse than none, because people trust it. Set two fixed checks a year, for example in spring and autumn, when one person calls or messages each number and updates the page. Also update it whenever someone joins, leaves or changes role, and whenever you change provider. After any real incident, add what was missing; a short blameless review, as in a post-incident review for internal systems, shows which contacts were hard to find.
A first version in one afternoon
Start with a blank page and the four blocks above. Fill in only the contacts you have actually used or would need tomorrow. Print it, put it in three places, and ask one colleague to try it: pick an imagined event and see how quickly they can name the first three calls. Fix whatever slowed them down, and the sheet is ready.
