Planning Is Not Preparation: The Dangerous Gap in Emergency Readiness

Oct 21

Emergency Planning vs Preparation: What a School Lockdown Drill Taught Me About Protective Security

The children knew what to do. The substitute teacher didn't. A real-life school lockdown exercise raises important questions about emergency preparedness, staff training and the difference between having a security plan and being capable of delivering it.

By Sean Keelan | Blue Light Security Solutions Ltd

The children knew what to do. The teacher didn't.

Something my son recently told me about a lockdown drill at his school has stayed with me.

Not because an attack occurred. Thankfully, it didn't.

But because the exercise revealed a weakness that could have had serious consequences had the circumstances been real.

The school had established lockdown procedures for responding to a marauding attacker. The pupils had previously participated in drills and had some understanding of what was expected of them.

On this particular day, however, their regular teacher was absent.

A substitute teacher was taking the class.

When the lockdown exercise began, she had not been told that a drill was going to take place. More importantly, she was unfamiliar with the procedures she was expected to implement.

She was unable to secure the classroom doors. She did not know where the children were supposed to shelter or how to implement the school's lockdown arrangements.

The pupils had practised.

The adult responsible for their safety had not.

Fortunately, it was an exercise.

But it left me thinking about a question that extends far beyond schools.

If an organisation has an emergency plan, but the people responsible for implementing it cannot carry out the necessary actions, can that organisation genuinely claim to be prepared?

I would argue that it cannot.

And I suspect this problem is considerably more widespread than we might like to admit.

What is the difference between emergency planning and emergency preparation?

In the security industry, we frequently use the terms planning and preparation as though they mean the same thing.

They don't.

Emergency planning is the process of deciding what an organisation should do in response to a threat or incident.

It involves identifying risks, assessing vulnerabilities, developing procedures, assigning responsibilities and establishing appropriate responses.

Emergency preparation is the practical process of ensuring the organisation is capable of implementing those procedures.

It involves training people, testing equipment, rehearsing responses, familiarising staff with their responsibilities and identifying weaknesses before an emergency occurs.

Consider a school lockdown procedure.

The plan might state that, upon activation of the lockdown alarm, teachers must secure classroom doors, move pupils away from danger and follow the school's established communication arrangements.

That is planning.

Ensuring every teacher, including temporary and substitute staff, understands those responsibilities and can physically implement them is preparation.

The difference is fundamental.

A plan describes an intended response.

Preparation develops the capability to deliver it.

An organisation can be well planned and poorly prepared at the same time.

That is precisely what concerned me about my son's experience.

The military's seven Ps: an old saying with an important lesson

There is a well-known saying, commonly associated with military training and operational planning:

Prior Preparation and Planning Prevents Piss-Poor Performance.

The seven Ps.

It is hardly the most diplomatic expression, but its message is difficult to dispute.

Effective performance under pressure rarely happens by accident.

It is usually the result of work undertaken long before the situation develops.

What interests me about the saying is that it specifically includes both preparation and planning.

Not simply planning.

A military unit might have a detailed operational plan, but that plan is of limited value if personnel have not been trained, equipment has not been checked, communications have not been tested or responsibilities have not been understood.

Exactly the same principle applies to protective security.

A security manager can produce an impressive emergency response plan.

It might contain detailed risk assessments, decision-making structures, evacuation procedures, lockdown arrangements and communication protocols.

It may have been reviewed, approved and distributed throughout the organisation.

But can the people responsible for implementing it actually do so?

Can they make the necessary decisions under pressure?

Can they operate the equipment?

Do they understand what actions are expected of them?

And what happens when the person who normally performs a particular role is absent?

The existence of a plan demonstrates that planning has taken place. It does not demonstrate operational readiness.

The substitute teacher problem: who is responsible when the regular person is absent?

What makes the school incident particularly revealing is that it exposed a vulnerability which might otherwise have remained hidden.

The pupils had been familiarised with the lockdown arrangements.

But the system appeared to depend on the knowledge of the regular teacher.

When that teacher was absent, the arrangements did not function as intended.

This raises an important question about temporary staff, contractors, agency workers and anyone else who may be expected to assume responsibility during an emergency.

Many organisations build their emergency preparedness around permanent employees.

Those employees attend training sessions, participate in exercises and gradually become familiar with their workplace procedures.

But what happens when they are not there?

Consider a few examples.

A shopping centre employs a temporary security officer to cover sickness. The officer has an SIA licence and considerable security experience, but has never been briefed on the centre's lockdown arrangements.

A corporate office uses an agency receptionist who is unfamiliar with the emergency communications system.

An events venue relies on casual staff who have never participated in an evacuation or invacuation exercise.

A school appoints a substitute teacher who has not been shown how to secure the classroom during a lockdown.

Each organisation may have a perfectly reasonable emergency plan.

But the effectiveness of that plan depends on people who may not have received the preparation necessary to implement it.

And I would be reluctant to place the blame entirely on those individuals.

If someone is placed in a position of responsibility without being provided with the information, training or resources needed to perform that role, we should be questioning the management arrangements that allowed it to happen.

This is particularly relevant to the private security industry.

An experienced security officer is not automatically familiar with the emergency arrangements of every site they attend.

Site-specific instructions, familiarisation and practical understanding remain essential.

A security procedure should not become ineffective simply because the person who normally carries it out is on annual leave.

A successful lockdown drill does not necessarily mean an organisation is prepared

There is another issue worth considering.

Organisations frequently measure preparedness by the number of exercises they conduct.

A school might undertake two lockdown drills each year.

A business might carry out an annual evacuation exercise.

A venue might complete a tabletop counter-terrorism exercise.

These activities are valuable.

But what exactly are they demonstrating?

If the same employees perform the same actions, in the same locations, under familiar circumstances, the exercise may demonstrate that those individuals can repeat a rehearsed procedure.

It does not necessarily demonstrate that the organisation can respond effectively when circumstances change.

What happens if the designated incident lead is absent?

What happens if a door cannot be secured?

What happens if the alarm cannot be heard in part of the building?

What happens if communications fail?

What happens if a member of staff is unfamiliar with the premises?

And what happens when the incident develops in a way the original plan did not anticipate?

These questions matter because emergencies rarely unfold according to a convenient script.

That does not mean we should deliberately surprise untrained staff with distressing scenarios.

Quite the opposite.

Exercises should be carefully managed, proportionate and appropriate to the people involved. In schools, particular care must be taken to consider children's ages, vulnerabilities, additional needs and emotional wellbeing.

But an effective exercising programme should progressively examine the resilience of the organisation's arrangements.

It should test the assumptions upon which the plan depends.

And when an exercise reveals a weakness, that should be viewed as an opportunity to improve.

The purpose of an exercise is not to prove that a plan is perfect. It is to identify what needs improving before the consequences become real.

What does UK guidance say about school lockdown procedures?

The distinction between planning and preparation is reflected in official UK protective security guidance.

The Department for Education's Protective Security and Preparedness for Education Settings guidance addresses the need for education settings to prepare for terrorism and other major incidents.

It recognises the importance of staff understanding appropriate responses and being familiar with the premises.

The guidance specifically addresses practical lockdown arrangements, including the need for staff to understand how to secure rooms and respond appropriately.

It also recognises that exercises involving children should be age-appropriate and consider the needs of vulnerable learners.

This is important because an emergency response plan must work for the people who are actually present, not simply for the circumstances imagined when it was written.

The Department for Education also provides free ACT for Education counter-terrorism awareness training, developed with the National Counter Terrorism Security Office.

These resources can help schools strengthen security awareness and preparedness.

However, generic awareness training is not a substitute for practical familiarisation with a particular building.

Knowing what a lockdown is does not necessarily mean knowing how to implement one in a specific classroom.

And knowing that a door must be secured is of limited value if the person responsible cannot operate the locking mechanism.

Lockdown, invacuation and evacuation: knowing which response is appropriate

Another important aspect of emergency preparation is understanding that lockdown is not always the correct response.

Protective security arrangements may include several different response options.

Lockdown involves securing premises or areas to prevent or restrict access by a threat.

Invacuation involves moving people to a place of relative safety within a building or site.

Evacuation involves moving people away from danger, usually out of a building or affected area.

Each response has a different purpose.

The appropriate action depends on the nature of the threat, its location, the characteristics of the premises and the information available at the time.

ProtectUK specifically warns that poorly implemented lockdown arrangements can increase rather than reduce risk.

This is a significant point.

A procedure designed to protect people may have unintended consequences if it is activated at the wrong time or implemented incorrectly.

For example, securing a building may protect those already inside, but could also affect people attempting to reach safety.

These are difficult decisions, particularly during a fast-moving incident.

It is therefore not enough for staff to memorise a sequence of actions.

They need to understand their responsibilities, the purpose of the procedures and how to respond appropriately within the organisation's established arrangements.

Preparation should develop understanding and competence, not simply familiarity with instructions.

Martyn's Law and the importance of organisational preparedness

The Terrorism (Protection of Premises) Act 2025, commonly known as Martyn's Law, has brought renewed attention to protective security and organisational preparedness.

The legislation is intended to improve the way qualifying premises and events prepare for potential terrorist attacks.

Its public protection procedures cover four key areas:

Evacuation
Invacuation
Lockdown
Communication

The accompanying government guidance places considerable emphasis on ensuring that people with responsibility for implementing procedures understand what is required of them.

It also recognises the value of training and instruction tailored to the particular premises and the responsibilities of individual staff.

This is particularly relevant to the school incident.

An organisation cannot assume that issuing a written procedure automatically provides the competence needed to implement it.

Nor should it assume that general security qualifications remove the need for site-specific familiarisation.

The broader message is straightforward.

Protective security is not simply about having procedures. It is about ensuring those procedures can be implemented effectively by the people expected to deliver them.

Martyn's Law should encourage organisations to consider that distinction carefully, rather than treating protective security as another documentation exercise.

Preparing people, not just producing paperwork

Having spent more than two decades working in policing and the private security industry, I have seen the considerable emphasis organisations can place on documentation.

Risk assessments.

Assignment instructions.

Emergency response plans.

Standard operating procedures.

Business continuity arrangements.

All are important.

I would never suggest otherwise.

Without appropriate planning, organisations risk relying on improvisation when people may be frightened, confused and faced with decisions carrying serious consequences.

But there is a danger in confusing the completion of a document with the completion of the task.

A procedure can be professionally written, logically structured and formally approved while remaining practically unworkable.

It may depend on equipment that has never been tested.

It may assign responsibilities to someone who is not always present.

It may assume staff possess knowledge they have never been taught.

Or it may rely on security measures that cannot be implemented in the time available.

These are not necessarily weaknesses that will become apparent during a document review.

They become apparent when someone attempts to put the plan into practice.

This is why practical preparation matters.

It bridges the gap between what an organisation intends to happen and what its people can actually achieve.

Seven questions every organisation should ask about emergency preparedness

If I were reviewing an organisation's emergency arrangements, I would want to understand more than whether it had a written plan.

I would ask seven questions.

1. Do the people responsible for implementing the plan understand their roles?

Not simply whether they have received a copy of the procedure, but whether they can explain what is expected of them.

2. Are temporary staff, contractors and new starters included?

Does emergency familiarisation form part of the induction process for anyone who may have responsibilities during an incident?

3. Have the physical security measures been tested?

Can the relevant doors be secured? Can alarms be heard? Do communications systems work where they are needed?

4. Can the organisation respond when key personnel are absent?

Is there sufficient resilience within the system, or does the entire response depend on one experienced individual being present?

5. Have staff practised their responsibilities?

Have they received appropriate practical instruction, rather than simply being asked to read and acknowledge a document?

6. Are exercises designed to identify weaknesses?

Do they examine realistic operational challenges, or simply repeat familiar routines?

7. Are lessons identified actually acted upon?

When a weakness is discovered, is someone responsible for correcting it? Is the action recorded, completed and subsequently verified?

These questions apply to schools, but they are equally relevant to offices, retail premises, events, transport environments and publicly accessible locations.

They are also relevant to security companies deploying personnel to unfamiliar sites.

In many cases, improving preparedness does not require substantial expenditure.

A short briefing, a practical demonstration, a functioning communication system or a check of a locking mechanism may make a meaningful difference.

But these activities must take place before an emergency occurs.

Frequently asked questions about emergency planning and preparedness

What is the difference between emergency planning and emergency preparedness?

Emergency planning establishes the procedures, responsibilities and intended actions for responding to an incident. Emergency preparedness involves the training, equipment, exercises and practical arrangements necessary to implement those procedures. An organisation needs both to respond effectively to emergencies.

Should substitute teachers receive school lockdown training?

Substitute teachers should receive appropriate information and familiarisation relevant to their emergency responsibilities before being expected to carry them out. The precise arrangements will depend on the school's procedures and risk assessment, but temporary status should not leave someone responsible for pupils without essential emergency information.

How often should schools conduct lockdown drills?

There is no single drill frequency appropriate to every education setting. Schools should follow relevant guidance and adopt a proportionate, risk-based approach that considers pupils' ages, additional needs and wellbeing. Staff-only exercises, practical familiarisation and other forms of testing may be appropriate, particularly for younger learners.

How can an organisation test whether its emergency plan works?

Testing can include equipment checks, staff briefings, practical rehearsals, tabletop exercises and appropriately managed drills. The important consideration is whether the exercise demonstrates that the required actions can be delivered, identifies weaknesses and results in meaningful improvements.

Is a written lockdown procedure enough?

No. A written procedure provides an essential framework, but it cannot demonstrate that staff understand their responsibilities, equipment works or the intended response can be implemented. Practical preparation and appropriate testing are necessary to establish confidence in the arrangements.

The question every school and security manager should be asking

Returning to my son's school, I am pleased that the weakness became apparent during an exercise rather than a genuine emergency.

I do not know what internal review followed or whether changes have since been made.

And I have no interest in publicly criticising the school or the substitute teacher.

In fact, the experience has made me think more about how organisations support the people they place in positions of responsibility.

If someone is expected to protect others during an emergency, surely we have a responsibility to ensure they are equipped to do so.

That responsibility cannot begin when the alarm sounds.

It must begin much earlier.

With planning.

With training.

With practical familiarisation.

With testing.

And with the willingness to acknowledge when something does not work.

The school's lockdown exercise may have exposed an uncomfortable weakness, but it also created an opportunity to address it.

That is the real value of exercising emergency procedures.

Not the satisfaction of recording another successful drill.

But the opportunity to discover whether our arrangements will actually work when they are needed.

So perhaps the most important question for anyone responsible for protective security is not:

Do we have an emergency plan?

It is:

If an emergency happened today, with the people we actually have on site, could we implement it?

Because a real emergency will not wait for the regular teacher to return.

It will not wait for the experienced security officer to start their shift.

And it certainly will not wait for the person who wrote the procedure to arrive.

Planning tells us what we intend to do. Preparation determines whether we are capable of doing it.

The difference matters.

And in protective security, it could make all the difference.

About the author

Sean Keelan is a former police officer with more than 20 years' experience across policing and the private security industry. He is the founder of Blue Light Security Solutions Ltd, a UK security company delivering professional security services and risk management support.

Sean is a Member of the Security Institute (MSyI), a member of ASIS International and a Freeman of the Worshipful Company of Security Professionals.

His professional interests include counter-terrorism, protective security, emergency preparedness and the protection of publicly accessible locations.