Incident commander

In an incident with clear physical boundaries such as a house fire, the site is referred to as being “inside the yellow tape.” Coordination and command of an incident at the site is led by an incident commander. The incident commander title is commonly used and it reflects the coordination and command structure of many response organizations and agencies.

However, if several response organizations use the incident commander title internally, having multiple incident commanders at the site may lead to confusion. In this case, IMS supports the use of the title incident manager as an alternative to incident commander.

The optional alternative: Incident manager

The incident manager title may be useful for coordination of complex incidents such as a health emergency which may have multiple sites or no defined site. In these incidents, there will be multiple response organizations involved and the coordination and command function may or may not involve setting objectives, strategies and tactics for the incident response.

In complex incidents, the coordination and command function may take place through a network approach. This is a more decentralized and collaborative approach where response organizations set their own objectives, strategies and tactics.

The incident manager will set high-level objectives, but their primary role may be to manage the communication, coordination and collaboration between multiple incident response organizations through a regular planning cycle consisting of phone calls, in-person meetings and other forms of scheduled contact. Below are some questions to consider when choosing the incident manager title:

  • Is there a clearly defined site?
  • What is the organizational structure of the incident response organization?
  • Does the organization have legislative authority that requires them to assume a command role?
  • Is the incident highly complex and decentralized, with no single site?
  • Does one or more incident response organizations use the incident commander title which could cause confusion?

6.1 Site coordination and command

The incident commander is responsible for the overall management of an incident response effort at the site. A single incident commander (or in rare cases unified command) is responsible for the coordination and command function.

The coordination and command staff (also known as the command staff) work directly with the incident commander to carry out the coordination and command function. The general staff then lead functional sections (see Chart 1: Incident management organizational chart) and report directly to the incident commander. Together, the coordination and command staff and general staff support incident coordination and command and may provide specialized knowledge, skills and advice to respond to an incident.

IMS is scalable

An incident may only require one or a few incident responders. The incident commander may respond on their own or with only one or two functional sections stood up. In this case, all other functions still need to be performed. This means that if the operations section is the only section that has been stood up, the incident commander is responsible for ensuring that the functions under the planning, logistics, finance and administration (and when required, public information management) sections are carried out.

Chart 1: Incident management organizational chart

An organizational chart to describe the incident response structure. It consists of incident command (green box) and is divided into functional sections including: an operations section (red box), planning section (blue box), logistics section (yellow box) and finance and administration section (grey box).

  • Incident command
    • Operations section
    • Planning section
    • Logistics section
    • Finance and administration section

The incident response structure is divided into functional sections. Each section is responsible for carrying out specific activities that support the incident response.

Every incident will have unique needs. Some incidents will need all sections to be stood up while others may not need every section. In smaller communities and organizations, there may not be enough personnel to fill every section. When an incident requires fewer personnel or if the organization does not have enough personnel for an incident response, existing personnel can perform multiple functions. In some responses, the incident commander may perform all of the functions. In other responses, an EOC may have an EOC director, a combined operations and planning section chief and a combined logistics and finance and administration section chief.

6.2 Coordination and command staff (also known as command staff)

Chart 2: Site coordination and command staff

An organizational chart that describes the site coordination and command staff structure. In green boxes it consists of an incident commander, liaison officer, safety officer, emergency information officer and a scribe.

  • Incident commander
    • Liaison officer
    • Scribe
    • Safety officer
    • Emergency information officer

The site coordination and command staff structure may include a liaison officer, a safety officer and an emergency information officer (EIO). A scribe is also recommended to take notes and document key activities. Note: positions are only filled as required.

This incident response structure may also apply to an EOC if the EOC is responsible for coordination and command of the site. For example, there is usually no defined site in an infectious disease outbreak that becomes a pandemic. In this case, coordination and command of the pandemic response may take place at an EOC.

Coordination and command staff roles

Liaison officer

  • the primary contact for incident response organizations; reporting directly to the incident commander
  • incident response organizations may include all levels of government, first responder services, nongovernmental organizations (NGOs) and private sector organizations
  • incident response organizations may provide knowledge, skills and/or other supports arranged through the liaison officer

Safety officer

  • monitors safety conditions and develops safety measures for an incident
  • assesses and communicates information on hazards that are present within an incident
  • advises the incident commander (or unified command) on matters relating to the health and safety of incident responders
  • ensures that the required personal protective equipment (<abbr>PPE</abbr>) is worn
  • contributes to the safety portion of the IAP and/or incident medical plan as needed
  • coordinates safety efforts if more than one response organization is involved in the incident
  • has the authority to change, suspend or stop any activities that are deemed hazardous in order to protect the health and safety of incident responders

It is important to note that final responsibility for health and safety matters in an incident rests with the incident commander.

Emergency information officer (EIO)

The Emergency Information Officer (EIO) communicates with the public and liaises with the media to provide information relating to an incident. In a large incident, the EIO may lead a team of communications personnel. In this case, the EIO would be responsible for the Public Information Management Section. Some communities and organizations may prefer to establish the public information management function into a distinct section with the EIO leading the function as the Section Chief (see Section 7.10 – EOC public information management section (led by the EIO)).


Scribes take notes during meetings and teleconferences as well as documenting key activities, events, agreements and any matters of potential legal significance throughout an incident. In many police services, the scribe is responsible for accompanying the incident commander at all times, taking notes at all command meetings and documenting decisions made. Although a scribe may be assigned to take notes, documentation is the responsibility of all incident responders.

Additional roles

Scientists and technical specialists: In some incidents, a scientist or technical specialist may be needed to provide technical expertise and recommendations. Scientists and technical specialists may:

  • have specific responsibilities and authorities for incidents such as chemical spills or nuclear incidents
  • be included in the operations section or planning section as required
  • have a dedicated scientific/technical section stood up in an incident, but this is rare and usually only happens in an EOC (see Section 7.13 – Scientific/Technical section)

Deputy incident commander: In a large or complex incident, an incident commander may appoint a deputy incident commander to assist with incident coordination and command. The deputy incident commander may also take site command while the incident commander handles other duties such as acting as a public spokesperson or briefing senior and elected officials.

Additional IMS functions at the site: In some incidents, additional functions may be required. At the site, additional IMS functions may include intelligence, investigations, scientific/technical, continuity of operations and emergency social services (ESS).

6.3 Planning section

The planning section is responsible for maintaining situational awareness, developing the IAP and long-term planning. The planning section function can be performed by the incident commander, by a planning section chief or an entire planning section may be stood up depending on the capacity of the incident response organization.

Making plans

The planning section has three main planning functions: incident action planning, long-term planning and contingency planning.

Incident action planning is the first priority for the planning section. Incident action planning activities include:

  • working with the incident commander and the other functional sections to prepare the IAP that captures incident objectives, strategies and tactics for the next operational period
  • producing and sharing a written version of the IAP

The planning section should develop long-term plans that consider all possible situations and resource needs beyond the current operational period as well as contingency plans that incorporate possible risks and outcomes based on the best and worst-case scenarios. The planning section should also develop demobilization plans.

Information management

The planning section at the site is responsible for the information management function by maintaining situational awareness and record keeping.

The planning section:

  • collects, confirms, analyzes and shares information about an incident
  • develops situation reports and ensures that up-to-date situation information is available to incident responders
  • manages documentation and records relating to an incident

6.4 Operations section

The operations section carries out the tactical activities necessary to implement the IAP. This includes managing the day-to-day response and establishing short-term planning.

The operations section chief should organize the operations section to meet the needs of an incident and make efficient use of resources assigned to an incident. Like all IMS sections, the operations section is scalable and the function can be performed by the incident commander, an operations section chief or an operations section stood up and staffed by incident responders.

The operations section coordinates all incident response actions. The operations section may include personnel from incident response organizations that have a major role in the response.

The primary responsibilities of the operations section include:

  • coordinating incident response activities
  • communicating with the incident commander and other functional sections to keep incident responders informed of the current situation
  • supporting the development of the IAP, including the development of strategies and tactics to achieve incident objectives
  • implementing the IAP and making adjustments if necessary as the situation changes
  • the operations section chief is responsible for assessing whether any changes require the incident commander’s approval
  • managing the operation of all resources assigned to an incident
  • planning immediate response tasks in detail
  • coordinating volunteer activities

It is important to note that in a complex incident, the Operations Section may need to be expanded to include multiple branches such as volunteer management, victim services or emergency social services.

6.5 Logistics section

The logistics section performs several important functions at the site such as providing and tracking resources to support an incident response. The resources arranged support both the incident and the incident responders. For example, the logistics section may need to arrange the delivery of heavy equipment to the site and order food for the incident responders.

The logistics section works closely with the operations section to meet current resource requirements and also works with the planning section to anticipate future resource needs. The logistics section also works closely with the finance and administration section to coordinate the procurement, tracking and payment for resources as well as keeping records.

Resources may include:

  • personnel
  • equipment
  • supplies
  • services
  • facilities
  • telecommunications and IT support
  • transportation
  • medical services for incident response personnel

The primary responsibilities of the logistics section include:

  • ordering, receiving, storing and housing resources
  • setting up, maintaining and demobilizing facilities such as the incident command post
  • arranging transportation
  • setting up, maintaining and tracking telecommunications and IT equipment
  • providing medical services for incident responders
  • arranging food services

The logistics section has an important role to play at the site where a large amount of resources are higher in demand. During an evacuation coordinated by a municipality, the logistics section at the site may arrange food, shelter and other personal items for evacuees.

6.6 Finance and administration section

The finance and administration section is responsible for the financial and administrative aspects of an incident including tracking personnel time sheets. Typically, the majority of work under the finance and administration section is not carried out at the site.

Some complex incidents may require financial and administrative expertise at the site. This may be in the form of a single resource or multiple personnel to track costs, resources and other financial and administrative matters as required.

6.7 Bringing the sections together

All functional incident responders and functional sections must work towards common objectives and a common operating picture. It is important to avoid having incident responders and functional sections work independently of one another.

In order to work together effectively and efficiently, it is important to:

  • establish a planning cycle that includes regular communication (formal and informal) through situation reports, meetings and briefings
  • clearly define responsibilities, including the need to communicate effectively with all incident responders
  • encourage teamwork and team problem-solving
  • communicate situational awareness updates to the situation unit so they can be shared with incident responders
  • participate in training and exercises together to build relationships, trust and networks to become better prepared in an incident response