The First Five Minutes
The First Five Minutes
Organisations invest enormous effort trying to prevent incidents, and rightly so. Hazard identification, risk assessments, competent people, effective supervision and well-designed critical controls all reduce the likelihood of something going wrong. They remain the cornerstone of good organisational performance and should always be the primary focus.
Yet every experienced operational leader knows prevention has its limits.
Psychologist James Reason's work on organisational accidents reminds us that complex systems are protected by multiple layers of defence rather than a single safeguard. Most of the time those layers perform exactly as intended. Occasionally they don't. Equipment fails, conditions change, assumptions prove incorrect and people find themselves dealing with situations that no one expected to unfold quite the way they did.
When that happens, the conversation changes.
The question is no longer "How do we prevent this?" It becomes "How quickly can we recognise what has happened, mobilise the right resources and stop the consequences from becoming significantly worse?"
Those first five minutes are rarely discussed in boardrooms, yet they often determine whether an incident remains manageable or develops into something far more serious.
The International Council on Mining and Metals (ICMM) makes an important distinction through its Critical Control Management framework by recognising that organisations need controls which both prevent unwanted events and mitigate their consequences when prevention fails. While preventative controls understandably receive significant attention, corrective or mitigative controls often receive far less organisational scrutiny despite becoming the controls that matter most during a crisis.
The principle extends well beyond mining.
The Australian Resuscitation Council advises that survival following sudden cardiac arrest decreases by approximately 10 per cent for every minute defibrillation is delayed in victims with a shockable rhythm. An Automated External Defibrillator mounted on a wall does not save a life on its own. Its value lies in an organisation's ability to recognise the emergency, communicate effectively, mobilise trained responders and deliver treatment before the opportunity is lost.
Exactly the same principle applies to fires, confined space incidents, hazardous chemical releases, falls from height, mobile plant interactions and security events. The event itself may last only seconds, but the quality of the response often determines the outcome.
ISO 22320, the international standard for emergency management, emphasises the importance of timely situational awareness, coordinated decision-making and effective communication during incidents. These are not administrative functions that begin once an emergency is declared. They are operational capabilities that require planning, training, exercising and continual assurance long before they are ever called upon.
This is where I believe many organisations have an opportunity to think differently.
I've often observed considerable effort being invested in verifying preventative controls while comparatively little attention is given to assuring the capability of the controls expected to protect people once prevention has failed. Emergency response plans exist. Equipment is available. Training has been completed. But how often are organisations genuinely testing whether assistance can reach the right place, with the right equipment, within the time available to influence the outcome?
That is not simply a safety question.
It is an assurance question.
Recent events continue to reinforce this point. Investigations into serious incidents repeatedly demonstrate that organisational outcomes are influenced not only by why an event occurred, but also by how effectively it was recognised, managed and learned from. The lessons emerging from the Moorvale Mine engulfment incidents in Queensland are one example of how emergency preparedness, organisational learning and timely corrective action remain critical components of effective risk management.
Resilient organisations understand this intuitively.
They recognise that emergency response is not separate from safety, nor is it simply a compliance obligation. It is one of the final critical controls standing between an incident and its consequences. Like any other critical control, it deserves to be designed, exercised, verified and continually improved.
Perhaps organisations should ask themselves one additional question during every review of their critical risks.
If prevention failed tomorrow, how confident are we that the first five minutes would unfold the way we expect?
References
Australian Resuscitation Council & ANZCOR. Guideline 7 – Automated External Defibrillation in Basic Life Support.
James Reason (1990). Human Error.
James Reason (1997). Managing the Risks of Organisational Accidents.
International Council on Mining and Metals (ICMM). Critical Control Management Implementation Guide.
ISO 22320:2018. Security and resilience – Emergency management – Guidelines for incident management.
Safe Work Australia. Model Code of Practice: First Aid in the Workplace.
Secura Insight SI-004 – Response Time: The Forgotten Critical Control.
