Incident Management Team Roles and Responsibilities

A worker is injured, the supervisor is shouting, and three people have already decided they are in charge. That scene doesn't show a lack of effort. It shows unclear incident management team roles and responsibilities, and it's fixable before the next event tests the team.

Table of Contents

• Why the First 30 Minutes Reveal Whether Your Team Will Work
  • What Role Clarity Changes in Practice
  • A Lifecycle, Not a Single Event
• What an Incident Management Team Actually Is
  • The Work the Team Must Do
  • Functions Before Personal Titles
• Core Incident Management Team Roles Explained
  • Command and Safety Authority
  • Operations, Planning and Logistics
  • Communications, Care, Investigation and Liaison
• Statutory Duty Holders Versus Delegated Operational Roles
  • Officers and Due Diligence
  • Appointments Built Into the Emergency Plan
  • The New Zealand Difference
• A RACI Example for a Notifiable Construction Incident
  • Notification Timing Cannot Wait for a Complete Picture
  • How to Read the Matrix
• The Response Sequence and Who Owns Each Step
  • Steps One to Three Stabilise the Scene
  • Steps Four and Five Protect the Record
• Handing Over From Response to Investigation and Corrective Action
  • A Time Based Ownership Matrix
  • Closeout Needs Evidence, Not Good Intentions
• Human Performance Roles on the Incident Team
  • Give Challenge a Named Owner
  • Manage Fatigue and Rotation Deliberately
• Quick Reference Role Cards for Your IMT
  • Command, Safety and Operations Cards
  • Planning, Logistics and Communications Cards
  • Care, Investigation and Worker Liaison Cards
• Embedding These Roles in Your WHS Plan This Week

Why the First 30 Minutes Reveal Whether Your Team Will Work

A panel slips during a lift on a residential build and strikes a worker below. The supervisor runs toward the injured worker while calling instructions over a shoulder. Two labourers call 000 separately, another worker moves the panel to make access, and nobody records names, times or what the load was doing before it fell. The principal contractor's project manager isn't on site, and the most senior person present keeps getting interrupted by phone calls from the office.

Nothing in that scene is unusual. It is what happens when functions are assumed rather than allocated. People help where they can, duplicate the visible tasks and miss the less obvious ones, such as preserving the scene, isolating the lifting zone, meeting the ambulance and deciding who speaks to the family. Effort isn't the constraint. Coordination is.

What Role Clarity Changes in Practice

A controlled response looks quieter, not slower. One person gives directions, one person manages care and access, and one person starts a log while others secure the area. Workers know who to report observations to, and that person isn't also trying to perform first aid.

• Immediate risk control: A named lead stops nearby work, isolates energy or plant and prevents a second injury.
• Care and access: A first aid lead manages treatment and guides emergency services to the exact location.
• Information control: A scribe or planning lead records facts, times, decisions and open actions as they're confirmed.
• External contact: One authorised person notifies the principal contractor, senior management and, where required, the regulator.

The test isn't whether the chart looks complete in a site office. The test is whether a relief supervisor at 6 a.m. can name the person, deputy and next action without hunting through a folder.

A Lifecycle, Not a Single Event

The first half hour matters because errors there follow the incident for weeks. A disturbed scene weakens the investigation, a late notification creates a compliance problem, and an injured worker who hears nothing after hospital transfer loses confidence in the employer. Response, investigation, corrective action, regulator engagement and worker recovery need different owners at different times.

Human performance belongs in that same design. Fatigue, stress and unwillingness to challenge a senior person aren't side issues. They're predictable pressures, so the team structure needs explicit authority to pause, rotate roles and record disagreement.

By naming each function, appointing a primary and deputy, setting escalation triggers and defining handovers, a small business gets a team that can scale. A minor injury may need three people covering several functions. A serious incident needs the same functions, separated and supported.

What an Incident Management Team Actually Is

An Incident Management Team (IMT) is a set of functions that turns incomplete information into coordinated action. It isn't a meeting group, a contact list or the most senior people available on the day. The useful question is not who holds an impressive title. It's whether leadership, information, planning, operations, logistics, communications, care, investigation and worker liaison each have an owner.

That logic is well established in Australasia. The Australian Institute for Disaster Resilience incident management handbook reflects the principle that Australia's Australasian Inter-service Incident Management System (AIIMS) and New Zealand's Coordinated Incident Management System (CIMS) divide responsibilities into defined functions rather than concentrating them in one person. The handbook describes an IMT as bringing together functional specialists from inside and outside an organisation, including legal, communications and technical personnel.

The Work the Team Must Do

The team's core work follows a repeatable cycle. It assesses the incident, sets measurable response objectives, selects strategies and develops an action plan. It then monitors whether those actions work, reassesses risk as conditions change, manages resources and engages stakeholders, customers and communities where they're affected.

That cycle is forward looking. Australian guidance expects the team to prepare forecasts and predictions, not only record what has already occurred. On a construction site that might mean anticipating weather affecting an unstable structure. In manufacturing it might mean checking whether a failed guard exists on identical machines elsewhere before restart.

New Zealand's model makes the same separation explicit. The New Zealand Coordinated Incident Management System third edition update identifies the Controller as the person providing operational leadership, supported by function managers and key agency representatives who handle detailed work and specialist advice. Separate ownership of information, planning, operations and logistics stops the Controller becoming a single point of failure.

Functions Before Personal Titles

A functional model survives leave, shift changes and contractor turnover because the function remains even when the person changes. Job titles can stay on the organisational chart, but the incident plan should state functional authority in plain language. Who can stop work, authorise restart, release information, spend money, contact the regulator and close an action?

Workplace examples from other response disciplines reinforce the same point about pre assigned workflow ownership, and teams reviewing digital response arrangements can compare that functional logic with IR workflow examples. The setting differs, but the weakness is familiar. Unowned handoffs create delay regardless of the hazard.

Role allocation is therefore a preparedness task. The IMT should be described in plans and procedures before an incident, with deputies and activation triggers included. Improvising the structure during an emergency consumes the very decision capacity the structure is meant to protect.

Core Incident Management Team Roles Explained

The roles below use common titles, but the authority matters more than the label. A construction business may say Incident Controller, a manufacturer may say Incident Commander and a facilities contractor may use Emergency Coordinator. Each structure still needs the same coverage and a clear line to one accountable lead.

Command and Safety Authority

The Incident Commander owns the overall response, sets objectives, approves strategy and decides when escalation or stand down occurs. This role reports to senior management or the relevant officer for governance decisions, while functional leads report to the Commander during the incident. A deputy should be able to assume command without renegotiating authority. The Commander takes over as soon as the event exceeds routine supervisor control, and earlier where injury, regulator notification or multiple contractors are involved.

The Safety Officer watches the response itself. Responsibilities include checking rescuer safety, identifying secondary hazards, challenging unsafe recovery work and advising the Commander on controls before restart. This role needs direct access to the Commander, not a reporting line buried under Operations. On a small crew the supervisor may cover Operations and Safety initially, but that dual role should be temporary and visible. Once work becomes complex, one person can't direct tasks and independently challenge them well.

Operations, Planning and Logistics

The Operations Lead directs work at the scene. That includes stopping affected work, isolating hazards, assigning crews, controlling access and confirming assigned actions are completed. The role reports to the Commander and usually supervises supervisors, wardens or rescue personnel. A deputy is essential where operations continue across shifts or across separate work areas.

Planning is often the first function skipped and the first gap noticed later. The Planning Lead gathers and analyses information, maintains the incident log, tracks actions and prepares the next phase of work. This role also coordinates evidence requirements with the Investigation Lead so operational recovery doesn't accidentally destroy information.

The Logistics Lead obtains, transports, tracks and supports resources. That may cover replacement plant, lighting, barriers, specialist contractors, transport, food, communications equipment and relief personnel. Good logistics prevents Operations from leaving the scene to solve supply problems. Similar discipline appears in well run project structures, where planning and support functions are separated from delivery, a comparison set out in an ERP project roles guide. The project context differs, but overloaded coordinators fail in predictable ways.

Communications, Care, Investigation and Liaison

The Communications Officer controls internal updates, client and principal contractor contact, family liaison arrangements and any external statement. The role doesn't need to make every call, but every message should be coordinated and recorded. Conflicting accounts usually start when several managers give partial updates in good faith.

The First Aid or Emergency Lead manages immediate care within competence, calls and meets emergency services, and provides known details about mechanism of injury and hazards. This role should not also own scene investigation. Care takes priority, and mixing the roles delays both.

The Investigation Lead activates once life safety is controlled, although evidence preservation starts immediately. Responsibilities include securing records, planning interviews, identifying failed or missing controls and recommending corrective action. The role reports to a senior manager who can authorise resources, while keeping the Commander informed about scene access and restart limits.

A Contractor or Site Liaison coordinates principal contractors, subcontractors, labour hire providers and site occupants. In waste, cleaning and facilities work, this role may also manage client access and service continuity. The practical value is simple. Contractor supervisors receive one set of instructions and know where to send witness names, training records and plant information.

On a small residential crew, a senior manager may act as Commander by phone, the site supervisor may cover Operations and Safety, and an administrator may log actions and notifications. That can work for a limited event if the combined functions, deputies and escalation point are written down. It fails when everyone assumes the supervisor is also managing care, family contact, regulator notification and evidence.

Statutory Duty Holders Versus Delegated Operational Roles

Role charts often blur two different layers. The statutory layer identifies who carries legal duties. The operational layer identifies who performs tasks during an incident. Both are necessary, but they aren't interchangeable, and a neat delegation chart doesn't move a primary duty from one layer to the other.

Under the model WHS framework, a PCBU retains the primary duty to eliminate health and safety risks so far as is reasonably practicable, or minimise them when elimination isn't reasonably practicable, as explained in Safe Work Australia guidance on managing health and safety. The PCBU must also consult workers and coordinate with other duty holders. Giving a supervisor the title Incident Commander helps organise work. It doesn't remove the business's duty to provide a safe system of work, competent supervision, information, training and adequate resources.

Officers and Due Diligence

Officers sit in the governance layer. Their role is to exercise due diligence by maintaining current WHS knowledge, understanding the hazards of the business, ensuring appropriate resources and processes exist, and verifying that incident and hazard reporting systems are implemented and followed. During a serious incident, that translates into asking for verified facts, authorising resources, checking notification decisions and confirming corrective actions are closed with evidence.

That distinction protects operational staff from being handed accountability without authority. A WHS investigator can identify a failed exclusion zone. An operational manager may need to fund redesigned access, change a programme or stop a work method. An officer needs assurance that the decision was made and verified.

Businesses reviewing that split should map it against the responsibilities of a PCBU before assigning incident titles. The mapping usually exposes a common gap. Operational roles are named down to first aid, while the person who can approve major corrective action isn't identified.

Appointments Built Into the Emergency Plan

A PCBU must prepare and maintain an emergency plan suited to the workplace, covering effective response, evacuation, notifying emergency services at the earliest opportunity, medical treatment and assistance, testing, training and communication with everyone at the workplace, as set out in Safe Work Australia emergency plan duties for construction. The plan should therefore name the authorised emergency coordinator, wardens, first aid officers and backups before an incident occurs.

Safe Work Australia's emergency planning guidance also expects each person's role, responsibility and duty to be documented, with the facility emergency controller holding overall responsibility for functions performed by facility personnel, as described in the Safe Work Australia emergency plans guide. HSRs and affected workers belong in consultation and review arrangements. They aren't substitutes for management authority, but their knowledge often identifies practical weaknesses managers miss.

The New Zealand Difference

New Zealand businesses work under the Health and Safety at Work Act 2015 and WorkSafe NZ rather than the Australian WHS framework. The PCBU concept and the reasonably practicable test will look familiar to trans Tasman businesses, but notification requirements, terminology and guidance must be checked against New Zealand law. A shared functional structure can work across both countries. A shared legal checklist shouldn't be assumed.

A RACI Example for a Notifiable Construction Incident

A RACI matrix is useful when several parties touch the same decision. It names who is Responsible for doing the work, who is Accountable for the outcome, who is Consulted before action and who is Informed afterwards. Used well, it prevents both duplication and silent gaps. Used as a poster with too many accountable people, it creates the confusion it was meant to remove.

Consider a residential build where a falling panel hospitalises a worker. The principal contractor controls the site, a subcontractor employs the injured worker and a labour hire worker witnessed the lift. The first decisions involve care and scene control. The later decisions involve notification, family contact, evidence, work restart, corrective action and return to work.

Notification Timing Cannot Wait for a Complete Picture

In NSW, a PCBU must notify the regulator immediately after becoming aware that a notifiable incident has occurred, using the fastest possible means, under the NSW Work Health and Safety Act 2011. If notification is by telephone, the regulator can require written notice within 48 hours. The incident team therefore needs a person authorised to recognise the trigger, make the call, record what was supplied and maintain the scene within the permitted exceptions.

Processes vary between Australian jurisdictions. The plan should name the relevant regulator and contact method for every state or territory where the business operates. A national contact list that doesn't identify the local pathway isn't enough during a night shift incident.

How to Read the Matrix

Only one role should be accountable for each step. Several people can be responsible for tasks, but shared accountability usually means nobody checks completion. Consultation also needs timing. HSR input after restart has less value than HSR input when controls and restart conditions are being tested.

The matrix should be built for the business's real structure. A manufacturer can replace principal contractor with plant manager and client roles with affected production areas. A cleaning contractor working across client sites needs a liaison step for the site occupant. The lifecycle logic stays stable even where the titles change.

Practical rule: If a step has no named accountable person, it hasn't been assigned. It has only been mentioned.

The Response Sequence and Who Owns Each Step

Sequence matters because early actions can either protect evidence or erase it. For construction and industrial workplaces, response should follow a controlled order. People are protected first, hazards are isolated, the area is made safe, the scene is preserved, required notifications are made and the investigation follows.

That sequence is consistent with Safe Work Australia's model code of practice for construction work, which supports designing incident response responsibilities around protecting rescuers and injured people, isolating hazards, making the area safe, preserving the scene, notifying the principal contractor and regulator where required, and investigating the event. For construction, the WHS management plan should also identify people with defined safety responsibilities and briefly describe those responsibilities.

Steps One to Three Stabilise the Scene

The Operations Lead controls immediate work once the Commander activates the response. The first check is whether anyone entering the area could become a second casualty. Electrical supply, suspended loads, mobile plant, traffic, hazardous chemicals, unstable structures and confined space atmospheres all change the rescue method.

1. Protect people: The First Aid Lead manages care, while Operations controls bystanders and access.
2. Isolate hazards: Competent workers isolate plant or energy under Operations direction.
3. Make the area safe: Barriers, exclusion zones, spotters or traffic control are established before detailed examination.

Vehicle incidents need the same discipline around traffic, load stability and emergency access. Fleet based teams can use truck accident response steps as a prompt for scene specific checks, then adapt them to the workplace plan. Generic advice should never replace the site emergency procedure.

Steps Four and Five Protect the Record

The scene shouldn't be restored or disturbed except where necessary to save life, prevent further harm or control an ongoing danger. The Planning or Investigation Lead should secure photographs, equipment status, permits, SWMS, training records, risk assessments, witness accounts and relevant contractor information. Early photographs need context, including wide views, close views, controls in place and equipment settings.

Notification is a separate owned task, not an afterthought once the site is tidy. The Commander confirms who contacts the principal contractor, senior management and regulator, and the Communications Officer records times and content. Businesses formalising that workflow can align it with an incident management procedure so the response sequence, notification decision and evidence list sit together.

Restart needs its own decision. Operations may want production resumed, but Safety and Investigation need enough evidence and interim controls first. The Commander or accountable senior manager should record what was checked, what remains restricted and who authorised the restart.

This is also where software can help if it supports the field workflow rather than creating a second record later. Safety Space provides incident and injury reporting with assigned corrective actions and tasks, which gives supervisors and managers one place to capture the notification, investigation actions and verification evidence by site. The tool doesn't replace command decisions. It reduces reliance on scattered messages when those decisions need to be retrieved.

Handing Over From Response to Investigation and Corrective Action

Most incident teams are designed for the noisy first hour and underdesigned for the following month. The ambulance leaves, the scene is released and production pressure returns. At that point the incident can lose its owner unless accountability is transferred deliberately.

The scale of that follow up work is significant. Australia recorded 146,700 serious workers' compensation claims involving at least one week of lost time in 2024 to 25, with injuries representing 66.6% of those claims, according to Safe Work Australia key WHS statistics. Those figures underline why corrective action ownership and worker recovery aren't administrative extras.

A Time Based Ownership Matrix

A practical handover can be organised by phase rather than by seniority. Each phase ends with a named receiver, a record and open actions that carry across.

• Immediate control: The site supervisor and Operations Lead stop work, protect people and stabilise hazards.
• Coordination and notification: The Incident Commander confirms objectives, notifications, communications and scene restrictions.
• Investigation: The Investigation Lead owns evidence, interviews, control analysis and causal findings.
• Corrective action: The operational manager owns funding, implementation, due dates and verification.
• Recovery and consultation: HR, rehabilitation coordinators, treating providers, the injured worker and HSRs manage return to work and feedback.

The handover should be a short structured brief, not a forwarded incident form. It needs verified facts, unknowns, evidence secured, notifications made, restrictions still active, injured worker contact arrangements and actions already assigned. The receiver should confirm acceptance and identify anything missing.

Closeout Needs Evidence, Not Good Intentions

A systems based investigation tests whether controls were suitable, implemented and effective. It doesn't stop at a worker error if supervision, design, maintenance, workload, procurement or contractor coordination contributed. An ICAM investigation template can help structure that analysis, but the Investigation Lead still needs independence, technical input and access to records.

Each corrective action needs an owner, due date, risk priority, verification evidence and an effectiveness review. Closing an action because a toolbox talk occurred isn't the same as confirming the redesigned control works under normal production pressure. The person closest to the event may understand the failure best, yet a different manager may control the budget or engineering change needed to prevent recurrence.

Useful measures go beyond response time. Managers can track the proportion of actions with named owners, overdue high risk actions, actions verified in the field, repeat findings and worker feedback on whether controls are usable. A technically correct command structure still fails if those measures show findings sitting unowned after the emergency ends.

Human Performance Roles on the Incident Team

A clear hierarchy helps during fast moving events. It doesn't guarantee good decisions. Fatigue, stress, incomplete information and reluctance to challenge seniority can narrow attention just when weak signals matter most.

Capability guidance treats those pressures as operational. An Australian Journal of Emergency Management review of incident management capability identifies leadership and teamwork, strategic thinking and planning, and self awareness as core capability groups, with self awareness including monitoring stress and fatigue, resilience, agility and adapting to feedback, while mental health conditions accounted for 12% of serious claims in the latest cited national release, 14.7% higher than in 2022 to 23 and 161% higher than a decade earlier. That combination makes human performance a design requirement, not a wellbeing slogan added after the event.

Give Challenge a Named Owner

Teams should decide in advance who can pause work, challenge the Commander, request specialist support and require a decision to be reconsidered. A Safety Adviser or Worker Liaison can hold that function, with direct access to the Commander and a duty to raise concerns from workers, contractors and HSRs. The role works only if challenge is expected and recorded.

Structured disagreement protects the Commander as well as the workforce. A short check can separate confirmed facts, assumptions, unknowns and decisions that can't be reversed. If a concern is overruled, the log should show the concern, the decision and the reason. Silent disagreement tends to resurface as non compliance, rumour or a poor restart decision.

A worker who can say the exclusion zone won't hold during deliveries is providing operational intelligence. The team structure should make that information easy to raise before restart, not brave to raise afterwards.

Manage Fatigue and Rotation Deliberately

Long incidents, night work and emotionally difficult events degrade judgement. The Planning Lead or Commander should track hours in role, upcoming shift patterns and who can relieve critical decision makers. Fatigue triggers can be simple. Set maximum periods before review, plan meal and rest breaks through Logistics and require a documented handover when the Commander, Operations Lead or scribe changes.

Rotation also needs competence. Putting a rested person into command without a brief can create a new risk. The incoming role holder needs objectives, decisions made, active restrictions, external commitments and the next decision points.

Psychological support should be assigned rather than left to informal check ins. The Worker Liaison or HR representative can coordinate contact with the injured worker, witnesses and close workmates, arrange support options and keep operational questioning separate from welfare contact. Debriefs should focus on learning and system conditions. If workers expect blame, they'll give shorter answers and the investigation will receive a cleaner story than the work produced.

The trade off is real. Strong command reduces debate when seconds matter, but unchecked hierarchy suppresses information. A mature team keeps one accountable decision maker and still makes dissent, fatigue monitoring and relief planning part of the commander's job.

Quick Reference Role Cards for Your IMT

Role cards convert the structure into something a supervisor can use under pressure. Each card needs a one line purpose, primary responsibilities, deputy, activation trigger and handover receiver. Cards should fit the site's actual titles and phone numbers, and they should be reviewed when personnel or work patterns change.

Command, Safety and Operations Cards

• Commander: Sets objectives, approves strategy, authorises escalation and restart, confirms notifications and closes the response. Deputy is a named senior supervisor or manager. Activates for serious injury, dangerous incident, multi contractor impact or regulator involvement. Hands over to the operational manager for corrective action closeout.
• Safety Officer: Checks rescuer safety, secondary hazards, isolation and interim controls. Deputy is a competent supervisor or WHS adviser not directing the task. Activates with the response and stays involved through restart. Hands unresolved control issues to the Investigation Lead and action owner.
• Operations Lead: Stops work, secures the area, assigns field tasks and confirms completion. Deputy is the relief supervisor. Activates immediately and hands scene access requirements to Planning or Investigation once the area is stable.

Planning, Logistics and Communications Cards

• Planning Lead: Maintains the log, tracks facts and unknowns, coordinates evidence requests and prepares phase handovers. Deputy is a trained administrator or supervisor. Activates as soon as multiple actions or external parties are involved.
• Logistics Lead: Sources barriers, plant, lighting, transport, relief staff and specialist support. Deputy is a storeman, facilities coordinator or operations administrator. Activates when response needs exceed what's at the scene.
• Communications Officer: Coordinates management, principal contractor, client, family and workforce updates. Deputy is a senior administrator or manager with access to contact lists. Activates before external enquiries begin, not after inconsistent messages circulate.

Care, Investigation and Worker Liaison Cards

• First Aid Lead: Provides care within competence, calls emergency services and guides responders to the patient. Deputy is another trained first aid officer. Hands clinical information to emergency services and incident facts to the Commander.
• Investigation Lead: Preserves evidence, plans interviews, analyses controls and recommends actions. Deputy is a trained investigator from another area where independence is needed. Activates early for evidence and formally after immediate risks are controlled.
• Worker or HSR Liaison: Supports consultation, relays worker concerns, coordinates welfare contact with HR and checks proposed controls with affected workers. Deputy is an alternate HSR or supervisor. Hands recovery actions to HR or the rehabilitation coordinator.

Printed cards work best beside the emergency contact list and site plan, not buried in a policy manual. The cards should match the RACI matrix and response sequence exactly. If the card names one accountable person and the procedure names another, the team will follow whoever is loudest on the day.

Embedding These Roles in Your WHS Plan This Week

Start with the current emergency plan and mark every place where a role is described by job title without authority, deputy or activation trigger. Replace vague labels with functions, named primaries, deputies and one line purposes that a relief supervisor can understand. Check the regulator contact for each operating jurisdiction while that work is open.

Next, write the handover rules. Define when command passes from the site supervisor to a senior Commander, when Investigation takes control of evidence, who authorises restart and who owns corrective action after response closure. Add fatigue relief and challenge arrangements to the same page. A separate wellbeing procedure won't help if the Commander doesn't see it during the event.

Run a desktop scenario using a realistic serious incident. Include an absent primary role holder, a contractor witness, a family call and a restart request before evidence is complete. Record gaps as corrective actions with owners and dates. Brief supervisors, first aid officers, wardens and HSRs on the changes, then update role cards at the point of use.

Review the structure after incidents, exercises, personnel changes, new sites, changed layouts and new high risk work. Role charts age quickly in construction, manufacturing, cleaning, waste and facilities services because crews and client sites change. The document is useful only when the names, authority and contact pathways still match the work.

If incident roles, notification decisions and corrective actions are currently spread across paper forms, messages and spreadsheets, Safety Space gives Australian, New Zealand and US businesses one system for incident reporting, investigations, tasks and site records. Visit the site to see how those workflows can support the team structure set out in the WHS plan.