Since resources are often limited, performing a Hazard Identification and Risk Assessment is key to ensuring that emergency management programs (and resources) will be focussed on the areas of highest risk. Risk is generally understood to be a function of probability of a hazard and the severity of the consequences. Once risks have been assessed, a judgement call may need to be made as to whether to accept a given level of risk or take action.
The objectives of a risk assessment are to:

• Identify hazards in the facility
• Use probability and consequences to estimate the level of risk posed by various threats and hazards.
• determine the emergency management priorities of the building.
• determine whether to accept risk or take action.

For the purpose of BEMA, the risk assessment has been used to tailor the questionnaire and assign appropriate weightings to the scores.

Mitigation measures are those which can help to avoid or reduce the risk of a hazard occurring - either by reducing vulnerability or reducing the severity of the consequences. Mitigation has been described as the most difficult pillar because it aims to avert something that has not yet occurred. Mitigation measures taken by building management demonstrate foresight and due diligence. This is significant from a legal perspective.
There are many structural features in a building that can reduce risk such as fire safety features, proper storage facilities for hazardous materials, handrails on stairwells and security cameras.
Other mitigation measures are operational, such as establishing a Health and Safety Committee or documenting procedures to ensure that plant rooms and electrical rooms are kept clear of combustible materials or materials that are highly toxic when they come into contact with heat. Emergency mitigation procedures may not require much capital outlay and can be effective in reducing the vulnerability and severity of consequences of a hazard. Since operational measures may be relatively inexpensive, they should be given serious consideration, including those for hazards which have a low probability of occurrence but relatively severe consequences. Emergency policies, plans and procedures should be written in concise, clear, simple language and should be assembled with a clear table of contents.

Because emergencies can not be entirely prevented, and certain risks must be accepted, plans should be put into place to ensure an effective response in the event that an emergency occurs. Effective emergency management means being ready to provide a rapid emergency response when disaster strikes in order to help save lives and minimize damage. In an emergency, time may be of the essence, and should not be wasted. The key is in the planning. Being ready also includes training and exercises, and ensuring that adequate resources are available.
The role of emergency communications can not be underestimated. One of the most critical elements of an emergency plan is the list of contacts to obtain additional resources or assistance, and to inform staff, tenants and other stakeholders.
An important element in an Emergency Plan is Public Affairs. Unexpected circumstances fueled by events beyond our control, that disrupt normal operations are likely to bring the organization under the scrutiny of outsiders. Most facilities are likely to come under media scrutiny in the event of a serious emergency. How public affairs are managed within the first three hours will determine to a large extent how management will be perceived by the public. Although the facility may not have resources to designate an individual for each separate function of public affairs, nevertheless, there should at least be plans to ensure that the basic functions will be performed.
Emergency Plans should not be designed to impress by their thickness. Rather they are intended for those individuals and organizations that need basic information fast. Therefore they should:

• be as concise and clear as possible
• be written in simple language.
• have numbered pages
• have a clear table of contents
• be dated
• have supporting materials in clearly indexed appendices

Whereas preparedness is all about planning for something that might happen, response operations occur during and immediately following an emergency. They serve to preserve life, reduce injury and provide emergency assistance to victims, protect the environment and property, reduce the likelihood of secondary damage, and speed the recovery operation.
This section addresses human and physical resources that are needed to action the emergency plans, and which will enhance the response to an emergency. In addition to needing good emergency plans, emergency staff will also respond more effectively with a well-designed incident management system and equipment to enable them to manage an emergency until first responders are on the scene, as well as the knowledge and documentation to assist first responders when they do arrive.

Recovery is the phase of emergency management that continues until all systems return to normal or as close to normal as possible. The steps involved in any recovery effort following a disaster are usually expressed as short or long term. Short-term recovery focuses on restoring vital utilities and life support systems (e.g., power, water, sanitation, and communications), transportation infrastructure, the removal of debris, and the assessment of damage. Long-term efforts begin after some degree of stabilization has been attained and focus on business resumption. It can also involve exploring measures that will make the facility less emergency prone, thereby bringing the cycle full circle to risk assessment and mitigation.