Embracing the Incident Command System Above and Beyond Theory

By W. Michael Phibbs, M.H.R., and Michael A. Snawder
Depiction of law enforcement at the scene of an incident.


Today, law enforcement agencies operate in dynamic environments where simple calls for service can become complex critical incidents in a matter of moments. Regardless of department size, it is not a question of if personnel will become part of a critical incident but when. Both officers and supervisors must stand ready to respond effectively. 

In the aftermath of September 11, 2001, training in the National Incident Management System (NIMS) and Incident Command System (ICS) became mandatory for all officers. But, are they better prepared now that they have received the basic training? Have agency leaders embraced the training and incorporated its concepts into everyday operations, or do they plan to simply dust off the manuals if and when a significant event occurs? Department personnel can recognize ICS as something that will help employees do their jobs better or a necessary evil for receiving funds or reimbursement from the federal government. 

Many departments have the talent within their ranks to “wing it” when necessary, but will that always be enough? Do officers want to look back on an incident and feel a sense of pride, or are they content to say “We made it through that one by the skin on our teeth?” Fortunately, several agencies across the United States can provide guidance to other departments and reasons to change such views.



Regardless of policing strategy, ICS can be incorporated into any department. However, this task requires time, as well as commitment and support at the highest levels of the agency. Even then, personnel probably will encounter hurdles and internal resistance. Agencies that have overcome such difficulties can attest to the benefits and point out that using ICS creates a common platform for all responders to build strategies for resolving and recovering from incidents.

The system enhances the ability to create and focus on objectives, allows development and planning of effective strategies, increases officer and supervisor accountability, and facilitates clear communication. Incorporating the ICS model into a department’s daily routine develops familiarity, enabling it to become a low-risk/high-frequency response system that prepares personnel—down to the individual officer—with proven strategies and tactics to handle complex situations.

An incident could be a minor single-vehicle accident handled by one officer or a more complex event, such as a missing youth, requiring several officers and detectives, but every incident begins and ends with an individual officer. The specific circumstances of an incident dictate the extent of the necessary responses to be handled by one officer, a single department, or multiple agencies. Departments that have embraced ICS affirm that while it does not tell officers how to do their jobs, they gain a reliable framework on which to organize and prioritize what they already know to do.


ICS initially was developed by a group of seven fire agencies that came together in the aftermath of the disastrous 1970 wildfire season in California. The coalition took on the name “Firefighting Resources of Southern California Organized for Potential Emergencies (FIRESCOPE).”1 After September 11, 2001, police departments had to examine how they responded to small- and large-scale incidents.

Most incidents are local, but when faced with the worst-case scenarios, such as the terrorist attacks of September 2001, all responding agencies must…work together. The NIMS, in particular, the ICS component, allows that to happen, but only if the foundation has been laid at the local level. If a local jurisdiction adopts a variation of ICS that cannot grow or is not applicable to other disciplines, the critical interface between responding agencies and jurisdictions cannot occur when the response expands.2  

Lieutentant Phibbs serves with the Richmond, Virginia, Police Department and is a member of the Central Virginia All Hazards Incident Management Team.
Lieutentant Phibbs serves with the Richmond, Virginia, Police Department and is a member of the Central Virginia All Hazards Incident Management Team.
Captain Snawder serves with the Richmond, Virginia, Police Department and is a member of the Central Virginia All Hazards Incident Management Team.
Captain Snawder serves with the Richmond, Virginia, Police Department and is a member of the Central Virginia All Hazards Incident Management Team.


Proposals for adopting NIMS or ICS probably will meet resistance. People do not like change, and bureaucrats resist it. Police officials may say, for instance, that the required classes are too long, the system will not be put to use, or the forms are confusing.

ICS involves more than a standard set of forms and potentially confusing vocabulary. It serves as the operational philosophy that allows an organization to more effectively run its daily operations. The system allows agencies to develop objectives, strategies, and tactics to systematically respond to and effectively manage critical incidents through use of the “Planning P.”3

  • Create a set of objectives and overall goals.
  • Select and develop appropriate tactics.
  • Ensure the allocation of appropriate resources.
  • Review the plan and confirm it sound.
  • Communicate the goals, tactics, and expectations.
  • Establish accountability. Who is in charge, and what are they in charge of?


When police personnel assume that ICS does not work, it will take a concerted effort to put the model into practice nationwide. Claims of ICS being ineffectual are based on perceived inflexibility and research presented over 30 years ago.4

ICS opponents largely overlook or ignore two articles that challenge the original research, pointing out the flaw of “blaming…poor application of the system on the system itself and not those who apply it incorrectly.”5 Responding to an assertion that ICS results in “[o]verkill in resources,” one expert stated, “…[m]assive mobilization of resources is another people problem, not related to the design of the proper management of ICS. The Incident Action Planning Process incorporated very simple management control procedures for preventing both over- and underordering.”6 The other rebuttal article explained that the incident action plan, planning process, and documentation of actions are designed to reduce the problem of information loss.7 It further stated, “Whether or not the ICS is effectively coordinated with all potential players is a planning, training, and implementation problem, not a model problem.”8

Failures in personal communication and improper application of the framework became evident 20 years later during a high-profile school shooting. Fire and police chiefs had not met prior to the incident.9 Of course, this was not a failure of the ICS system. Had there been a properly implemented, unified command established within the ICS framework, the chiefs would have needed to meet, create a set of objectives, and deploy resources accordingly. A relationship between the two chiefs would have presented other benefits, and the departments could have avoided the difficulties resulting from never truly implementing the system.

ICS stands on the premise that in a major incident in which responders come from multiple agencies in various jurisdictions, there can be no assumption that prior professional relationships exist. The ICS process allows officers at any rank from any agency to come together and develop priorities, objectives, and plans to manage an incident. “Until new behaviors are rooted in social norms and shared values, they are always subject to degradation as soon as the pressures associated with a change effort are removed.”10 By internalizing ICS as a natural function of an organization’s operational philosophy, new behaviors can be established and proven.


The nationwide transition to ICS in law enforcement remains incomplete. Years after the events of September 11, many departments still struggle with the idea of integrating the ICS model into their individual operating philosophies. Jurisdictions that do not properly integrate the ICS model into their daily routines could face unnecessary difficulties when responding to large-scale emergencies, ultimately hampering their response.

As an example, an earthquake occurred in central Virginia on August 23, 2011. A high-rise building that housed several hundred elderly residents sustained structural damage, and some of those individuals needed medical attention.

“Regardless of policing strategy, ICS can be incorporated into any department.”

The police department’s incident commander had received basic training for NIMS and ICS, but that training alone proved inadequate due to the difficulties associated with suddenly transitioning from a normal routine into the ICS model. Although the commander had experienced earthquakes before while born and raised in California, most of his officers and the citizens present that day had never experienced anything like it. This element of unfamiliarity added more stress to the responders because they did not have a point of reference to draw from in terms of past experiences. Instead of creating a unified command with one command post, the police established one on the east side of the building, and the fire department established its own on the west side. At this point priorities were established; however, they were independent of one another. All communications occurred through a dispatcher, instead of face-to-face, making it more difficult to receive and direct necessary resources.

With two command posts at an event, how does a responder determine who is in charge and who to report to—the police department, fire department, or a nonpublic safety official? Who has the responsibility for making the call to transition from the rescue to the security phase of the incident? Although both agencies, ultimately, accomplished their missions that day, this incident serves as an example of how ICS becomes a low-frequency/high-risk system when an agency only uses it for large-scale events. The police department in this example has several members who have sought additional training as a result of becoming members of their local regional incident management team.

Spelling out roles and responsibilities before a critical incident is paramount to overall success when large-scale emergencies occur. Using ICS daily enables it to become second nature. When police address every incident from an all-hazards approach, everyone knows their roles and how they fit into the bigger picture. Organizations that practice ICS daily are more able to become high-reliability organizations because the system is scalable and sets the foundation, from a single officer to a multiagency regional response to critical incidents. Simply stated, consistent performance fosters reliability.


When implementing the ICS philosophy, agencies have three main points to consider: scalability, risk frequency, and supervision. One, all incidents begin with a single officer responding to a call for service. The responding officer may determine the need for more assets, and, eventually, outside agencies may have to handle a situation of substantial magnitude. Even so, the incident eventually will end with a single officer. Therefore, the ICS philosophy treats the differences between incidents as a matter of scale.

Two, ICS must become second nature for an organization to effectively respond to significant events. Using ICS as a part of daily operations engrains the philosophy into the thought process of officers responding to incidents. By employing ICS they develop the instinct to assess and handle any situation. Response to an incident too complex to handle at the immediate first level of response will be scaled up in a predetermined and understood way, thus, eliminating unnecessary confusion. For a department that does not practice ICS regularly, transitioning only when needed, ICS becomes low-frequency/high-risk. Conversely, for the department that practices ICS on a regular basis, situations become low-risk/high-frequency.

Three, in a department applying ICS, it will be recognized that the system is position specific, not rank specific. The most capable person present is assigned to the specific job regardless of rank. Assigning personnel based solely on rank can hamper an organization’s ability to respond effectively to a situation. A common phrase in ICS is “Leave your rank and ego at the door.” When departments train personnel on job-specific tasks related to ICS and then consider the officers’ expertise when assigning positions, a team is formed that can manage the incident.

“The system enhances the ability to create and focus on objectives, allows development and planning of effective strategies, increases officer and supervisor accountability, and facilitates clear communication.”

Of course, having a common language is imperative when one agency requests assistance for large-scale emergencies. Confusion can result when officers are expected to not only understand but retain unfamiliar definitions and descriptions after attending basic ICS classes. Examples include terms, such as single resource, strike team, task force, division, groups, and command posts, all carefully defined by the ICS vocabulary. Without shared understanding vital time is lost trying to translate one organization’s language into another.

For example, one department may deploy its personnel on shifts while another uses reliefs. The agency requesting assistance will have to determine how many people come in a relief or shift. ICS 100- and 200-level classes teach practical and easy-to-understand definitions so that all personnel should know that a single resource is one officer with a car. A strike team includes 10 single officers and 1 supervisor for a total of 11 personnel, but with no cars. If a department uses two-man cars, the definition would be 5 two-man cars and 1 supervisor, still equaling 11.

An emergency can happen at any time, and issues of identifying the correct resource in the correct configuration for mutual aid requests can not only make or break the response for the host agency but can also have serious implications for the assisting agencies.11


Outstanding organizations perfect themselves. By using ICS daily they actively seek out weakness where it exists and then adjust their practices to prevent failure in the future. By using the ICS system they develop a commitment to resilience. Employing the strengths within departments or assisting agencies is a critical component in the ICS system.

In 2005 the Henrico County, Virginia, Police Division (HCPD) began the process of building ICS into its operational philosophy. The process was long, and overcoming cultural resistance was a challenge. The culmination of the agency’s efforts led to the first truly unified incident action plan (IAP) between law enforcement and fire services for the spring 2013 NASCAR race. The department found that employing ICS involves not only the process but also relationships with other agencies within the county government. It is an understanding for incident commanders that they are not alone and that other organizations have expertise and resources to bring to an incident.

Like most departments prior to 2005, HCPD had an unusual occurrence plan; however, this plan did not call for many interactions with fire services. To transition to the ICS philosophy, department command staff members needed to learn and buy into the value of the system. A plan for collaboration with fire services had to be developed where professionals on both sides understood the inner operability of ICS. By using the skills from each branch, personnel collectively became more efficient and effective.

One of the greatest insights the agency found over the years is that the command staff must be serious about implementation. ICS is consistent with the idea that commanders must inspect the actions of their subcommanders and officers to ensure expectations are met. If agencies do not remain consistent when making changes, people who want to revert back to old methods can get a toehold for resistance.

HCPD learned that developing its culture into ICS enabled officers to see the success of the system and subsequently believe it works, thus, owning part of the success. The department recruited officers and sergeants who were cultural drivers to learn and implement ICS. As agency leaders began to use the system, views slowly changed. The implementation process was built from the middle out, not from the top down. As officers who understood how to effectively use the system were promoted, the culture began to evolve.

“Without shared understanding vital time is lost trying to translate one organization’s language into another.”

Command staff members realized that sending officers to ICS 100- and 200-level courses taught by firefighters reinforced the idea that “This is a fire program.” As a solution a cadre of police officer instructors teamed up with fire services instructors to create a holistic approach to teaching ICS. They developed an incident program where every student learned who is in charge of what and why. They learned not only to accept what other organizations bring to incidents but to celebrate what their own services contribute. Together they developed a collaborative approach where both law enforcement and fire responded jointly to determine priorities and processes, such as life preservation or scene protection, during a critical incident. One of the unique analogies they used during training was to explain the ICS positions by relating them to responsibilities that come with owning a house.

  • Incident commander: Determines that the house needs to be kept up to retain value.
  • Operations section: Determines what needs to be done to keep up the house, priorities, and who is doing what.
  • Planning section: Puts the plan and assignments in writing.
  • Logistics section: Orders the equipment needed, such as a lawnmower to cut the grass.
  • Finance section: Answers the question of “How are we going to pay for this?”
  • Safety officer: Ensures the family is wearing the right protective gear.

Initially, the green light signaling the command post was a difficult concept for police officers to embrace because they had never seen it before. However, it was necessary because the officers had to quickly identify the location to report and receive assignments. No longer could officers and detectives just show up on scenes and enter the area anywhere they wanted. They needed to check in at a specified point and leave from it after completing their assignments. Today the green light has been accepted, and units not only look for it but expect that it will be there every time.

An example given by the HCPD indicated that relationships and mutual respect between agencies began to manifest on a large scale during an incident one hot summer day. The event clearly required a large law enforcement response, but the local fire department was assigned to it and was standing by. HCPD asked the fire captain to serve as logistics chief for the rest of the incident. An official from HCPD stated, “The fire department has the expertise in rehabbing people on scenes. Let the people who know what to do, how to do it, and have the supplies to do it, do their jobs.”12 This broke a cycle that occurs in agencies across the nation where officers serve in positions they have never filled before, thus, allowing them to “stay in the game.” HCPD did not have to pull any officers from the scene and let them figure out what to do and where to get supplies with another agency’s budget. “The incident went a long way to solidify ties between law enforcement and fire services and permeate the philosophy up and down.”13 

HCPD subsequently participated in a unified command created for the spring 2013 NASCAR race. In light of the Boston Marathon bombings, the department felt it prudent to add an investigation/intelligence unit to the race’s incident action plan (IAP). This was consistent with the NIMS 2008 Manual, which states, “Incident management organizations must establish a system for collection, analysis, and sharing of information developed during intelligence/investigation efforts.”14 This was the first time an intelligence/investigation unit was added; however, HCPD indicated that it would not be the last due to its overall value.

Regarding the overall plan, the agency recognized that prior to embracing ICS, police and fire officials could not have come together the way they did. However, it took years for the department to work through the growing pains and cultural hurdles that came with first adopting and then embracing ICS.


In October 2013 the U.S. Department of Homeland Security published an updated Intelligence/Investigation Function Guidance and Field Operations Guide, which states, “The I/I function should be established as a general staff section when a criminal or terrorist act is involved.”15 The FBI will lead the investigation of any terrorist incident, regardless of size. The ICS is flexible in nature, and which functions should be activated depends on the scale of the incident. Intelligence/investigations can run concurrently with life-safety operations, and the incident commander makes the final determination of how the Intelligence/Investigation function will be incorporated into the overall command structure.

For small-scale or local incidents, an I/I section may not be needed. Assessing the scope of the incident will help determine the appropriate scale of the I/I functional needs and whether it should be in the form of a general staff section with its own branches, groups, and divisions; constitute a branch under operations; or, perhaps, simply fall under the planning section as a technical unit.

Regardless of how it is placed within the framework of ICS, the incident commander and the individual assigned to I/I can limit sensitive information to minimize the chance of it leaking out. When incorporating I/I into the IAP, classified information should be replaced with “pages intentionally left out” or “pages intentionally left blank,” with only need-to-know individuals having the full version. State fusion centers can collect information about potential threats and disseminate that information to those who need it for the investigation or for planning future operations.

When operating on a large-scale incident, operations and I/I section chiefs must communicate frequently to ensure the effective coordination of their activities. A specialist liaison officer can ensure that lines of communication remain open and that information and coordination move smoothly between agencies at the federal, state, and local levels involved in a specific incident.

Lessons Learned

The Orange County, Florida, Sheriff’s Office (OCSO) has taken a proactive approach to the implementation of incident command. It embraces ICS and understands that in a major critical incident, everyone in local government has a part to play. The department has created a 3-day course titled “The Unified Command School.” This program brings together managers from various agencies within city government and integrates them by using ICS to create one team. The training cadre set out not only to design a challenging program but also to develop a creative and fun learning environment. An important consequence of the training is the relationships built during the training cycle. Everyone in the class becomes a recognizable face, instead of a title on another organizational chart. When leaders have met and know each other prior to a significant event, ICS runs more effectively.

ICS creates the methodology to use, but the relationships built through the training enable things to be accomplished. There is no struggle to decide whether to take command. The continuity-of-efforts plan allows stakeholders to know and understand their roles in the process. By training and using the ICS platform on a local and regional level, the department has developed a common operating system in which responding personnel know what to expect from one another. Together they are better prepared to deploy the right assets at the right time to the right locations.

Orange County is on the forefront of incident command, but it has taken years to develop its high level of proficiency. Officials have learned that a highly engaged command staff is imperative to get the program going and to maintain momentum. If the command staff is not committed to doing more than the federal mandate, the program will fail. The sheriff’s department began by training all of its deputies in the mandated ICS classes.

A cadre was developed to teach the classes and then go to the different sectors to conduct tabletop exercises. Through these classes and exercises and the implementation at the street level, patrol officers began to see that ICS really works. Officers learned to make decisions early in an incident and act on them. When the command staff supports the program and an interactive training program is developed, the frontline officers see the success from the bottom up. The atmosphere then is conducive to developing synergy and improving upon an already successful program.

OCSO has learned that integrating ICS into its operating philosophy saves time and money in resolving incidents. By having the ICS philosophy built into its normal operations, it manages responses quicker. Responders at all levels have checklists to track from the outset of any potential incident. Deputies and supervisors have laminated cards that contain the “7 Critical Tasks” and can be carried in their uniform pockets.

  1. Assess the situation.
  2. Identify the danger zone.
  3. Establish an inner perimeter.
  4. Establish an outer perimeter.
  5. Establish the incident command post.
  6. Establish the staging area.
  7. Request additional resources.

Watch commanders and lieutenants use command stations that contain dry-erase boards, markers, notepads, and folders containing checklists from the department’s critical incident management guide for various situations. Numerous patrol sergeants and corporals also have dry-erase boards and markers to begin the ICS process upon their arrival on scene. As more resources are requested, use of the checklist confirms the completion of basic steps and if any additional ones have been taken to manage the incident. By managing the incident scene earlier and more effectively, officials may not need to request as many assets and ultimately could demobilize the ones on scene faster, thus, saving money for the taxpayer.

OCSO conducts a yearly hurricane exercise that involves various disciplines throughout the state. Also, once a year it conducts a full-scale exercise for Commission of Accreditation for Law Enforcement Agencies (CALEA) certification that includes private and federal agencies throughout the region. The department knows that when police and fire personnel respond to the same calls, priorities can conflict at management levels. OCSO is breaking down the barriers between law enforcement and fire services by integrating mid-level supervisors from both services into management and leadership training. The original thought behind the idea of integrated training was that first responders do not differ much from each other. Through the sharing of training and ideas, they increase efficiency and effectiveness on scene. An unanticipated benefit of the training came through opening up communication lines. Fire services personnel began to provide actionable intelligence of criminal activities observed while responding to fire and EMS calls.

Successful responses to large-scale critical incidents require regional responses and continuous cooperative training for seamless transitions when outside agencies are requested. OCSO continues to integrate other law enforcement agencies into its active-shooter scenarios that require a regional response to stop the threat. The department participates in training throughout the region on a fairly regular basis that includes several different agencies, such as the Orlando Police Department, Orange County Fire/Rescue, Orlando Fire Department, Orlando Regional Health Care, FBI, and Florida Department of Law Enforcement.

Orange County has developed a critical incident management team to respond to critical situations. All team members have attended both general and specific Federal Emergency Management Agency (FEMA) All Hazards Incident Training classes. When the unit is deployed, the members are credentialed to perform assigned tasks based on expertise, not rank. The team also works with its regional incident management team to respond to situations that are scaling up and requiring additional resources. By training together on small incidents and preplanned events, the process becomes natural.


Over time, the incident command system has had many detractors; however, several departments have demonstrated what can be achieved once it is embraced. These departments understand that they need to not only embrace ICS but actively partner with other first responders to learn differing perspectives. Breaking down the barriers that prevent organizations from using ICS is imperative today, when regional responses to significant incidents are becoming more common. To avoid the “silo” effect and to judge situations from a larger perspective, first responders must have an awareness of the capabilities of other responders.

During large events everyone in the locality has a seat at the table; it is only a question of when and how they will be used. “To become a strategic leader, you need to become proactive and take action now. The object is to start to think and act strategically, and handle the increased complexity resulting from the necessity to integrate elements that are, in some cases, far removed from your basic expertise and experience.”16

“Breaking down the barriers that prevent organizations from using ICS is imperative today, when regional responses to significant incidents are becoming more common.”

For additional information Lieutenant Phibbs may be contacted at William.phibbs@richmondgov.com, and Captain Snawder may be contacted at Michael.snawder@richmondgov.com.


1 Dana Cole, “The Incident Command System: A 25 Year Evaluation By California Practitioners,” http://www.usfa.fema.gov/pdf/efop/efo31023.pdf (accessed June 13, 2014).
2 Gil Jamieson, “NIMS and the Incident Command System,” The Police Chief, February 2005.
3 U.S. Department of Homeland Security, Federal Emergency Management Agency, “Incident Command System: Planning Process,” https://training.fema.gov/EMIWeb/IS/ICSResource/ assets/PlanningP.pdf (accessed June 13, 2014).
4 D. Wenger, E.L. Quanrantelli, and R.R. Dynes, “Is the Incident Command System a Plan for All Seasons and Emergency Situations?” Hazard Monthly, March 1990, 8-9.
5 Robert L. Irvin, “Challenging the Critics of ICS,” Hazard Monthly, June 1990, 9; and Margaret Dimmick, “ICS: Making Criticism Constructive,” Hazard Monthly, May 1990, 7.
6 Irvin, “Challengiing the Critics of ICS.”
7 Dimmick, “ICS: Making Criticism Constructive.”
8 Ibid.
9 T.J. Moody, “Filling the Gap Between NIMS/ICS and the Law Enforcement Initial Response in the Age of the Urban Jihad” (thesis, Naval Postgraduate School, Monterey, CA, September 2010), 1-106.
10 John P. Kotter, Leading Change (Boston, MA: Harvard Business School Press, 1996).
11 Barry Domingos, “Law Enforcement Operations Working Group Focuses Efforts on Resource Typing,” The Police Chief, February 2012.
12 Assistant Chief James Fitzgerald, Henrico County, Virginia, Police Division.
13 Ibid.
14 U.S. Department of Homeland Security, Federal Emergency Management Agency, “National Incident Management System,” http://www.fema.gov/pdf/emergency/nims/NIMS_core.pdf (accessed June 13, 2014).
15 U.S. Department of Homeland Security, Federal Emergency Management Agency, “National Incident Management System: Intelligence/Investigation Function Guidance and Field Operations Guide,” https://www.llis.dhs.gov/sites/default/files/NIMS_Intel_Invest_Function_Guidance.pdf (accessed June 13, 2014).
16 William A. Cohen, A Class with Drucker: The Lost Lessons of the World’s Greatest Management Teacher (New York, NY: AMACOM, 2008).