How do you know everyone got out?
Federal law answers that in eight words, and sets no deadline, no muster point and no way of doing it. The hard part was never the rule. It is that the count has to be right the one time it matters, made by people under stress, from a list that is usually indoors.
- The whole federal ruleProcedures to account for all employees after evacuation. 29 CFR 1910.38(c)(4).
- No time limit existsNo number of minutes appears in any OSHA emergency action plan standard.
- Nobody measures failureNo agency publishes a rate for how often a head count is wrong.
The only question that matters in the next ten minutes.
Not whether the plan is written down. Whether anyone is still inside.
The alarm goes. People leave by the nearest exit, which is not always the one on the plan. They gather where they can get to, which is not always the place on the sign. Then somebody with a clipboard, or a phone, or nothing at all, has to work out who is standing there and who is not.
That count is not paperwork. It is the input to a decision about whether to send firefighters into a burning building to look for a person who may already be in the car park. OSHA puts the point more plainly than most vendors do:
Take a head count after the evacuation. Identify the names and last known locations of anyone not accounted for and pass them to the official in charge. Accounting for all employees following an evacuation is critical. Confusion in the assembly areas can lead to delays in rescuing anyone trapped in the building, or unnecessary and dangerous search-and-rescue operations.
A count that says everyone is out, wrongly, is worse than no count at all. It buys the confidence to stand down.
What the rule actually says.
Eight words, and a great deal that people believe is in there and is not.
The federal general-industry requirement to account for people after an evacuation is one item in a list of six minimum elements an emergency action plan has to contain. It reads, in full:
Procedures to account for all employees after evacuation;
That is the whole of it. Read strictly, and it is worth reading strictly, the sentence says less than almost everybody assumes:
- It requires procedures, not a result. What has to be in the plan is a method. The standard does not grade the outcome.
- It sets no time limit. No number of minutes appears anywhere in 29 CFR 1910.38.
- It does not require a muster point. The word does not appear in the standard at all.
- It says employees. Not contractors, not visitors, not delivery drivers.
- It creates no duty to keep the record. There is no recordkeeping requirement attached to the count.
Construction has its own wording, and it is marginally stricter on its face: 29 CFR 1926.35(b)(3) requires procedures to account for all employees after emergency evacuation has been completed. Marine terminals and longshoring carry the same element at 29 CFR 1917.30 and 29 CFR 1918.100, and those two are the only federal OSHA text found that imposes an emergency action plan on all employers in scope rather than conditionally.
Does every employer owe a plan at all?
Not according to the standard itself. 29 CFR 1910.38(a) says an employer must have an emergency action plan whenever an OSHA standard in that part requires one. It is a specification for a plan that something else has already triggered, not a universal mandate. A page that tells you OSHA requires every employer to have one is wrong, and a safety manager will know it is wrong.
In practice almost everyone is routed into one anyway, and OSHA says so in its own words:
Almost every business is required to have an emergency action plan (EAP). If fire extinguishers are required or provided in your workplace, and if anyone will be evacuating during a fire or other emergency, then OSHA's [29 CFR 1910.157] requires you to have an EAP. The only exemption to this is if you have an in-house fire brigade in which every employee is trained and equipped to fight fires, and consequently, no one evacuates.
The route is a trade, not a blanket duty. Choose total evacuation on the alarm and take the extinguisher exemption, and the price is a plan that meets 29 CFR 1910.38, which includes accounting for all employees after evacuation.
The numbers everyone attributes to OSHA.
Both of the famous ones are real. Neither is a requirement.
One warden per twenty employees
This figure is genuinely in the Code of Federal Regulations, which is why it survives every fact check. What gets dropped is the first line of the document it sits in, which calls itself a nonmandatory guideline, and the hedging in the sentence itself:
Generally, one warden for each twenty employees in the workplace should be able to provide adequate guidance and instruction at the time of a fire emergency.
What 29 CFR 1910.38(e) actually requires is that an employer designate and train employees to assist in a safe and orderly evacuation of other employees. No ratio, no number, no title.
A deadline for the head count
There is not one. The emergency action plan standards and the appendix were searched for any number of minutes and for the words muster, head count, headcount and roll call. None of them appear, and the same search in the same pass found the words that are there, which is what makes the absence a finding rather than a failed search.
So if your site works to a target time, that target came from your own procedure, your insurer, a client site permit or a corporate standard. Any of those can bind you. None of them is OSHA, and it is worth knowing which is which before an auditor asks where the number came from.
Where the advisory line falls
A great deal of the most useful material OSHA publishes on this subject is guidance rather than regulation, and OSHA is explicit about the difference:
This Compliance Assistance product is not a standard or regulation, and it creates no new legal obligations. The Compliance Assistance product is advisory in nature, informational in content... However, failure to implement these recommendations is not, in itself, a violation of the General Duty Clause. Citations can only be based on standards, regulations, and the General Duty Clause.
The same applies to OSHA's booklet on workplace emergencies, which states on its own first page that it does not alter or determine compliance responsibilities. It is also twenty-five years old, which is worth knowing before quoting it as current practice. OSHA 3088, How to Plan for Workplace Emergencies and Evacuations
The four ways it is actually done.
Each one works somewhere. Each one has a failure that is specific to it.
- A printed roster carried to the assembly area. Costs nothing, needs no signal, and works in the dark. It fails when the printed copy is a week old, when the person who carries it took a different exit, and, most often, when the copy is still inside the building.
- Calling names aloud. Fast for a small crew who all know each other, and the only method that needs no equipment whatsoever. It is also the method that degrades hardest under stress, and it fails silently when two people answer to the same name.
- Badge readers and turnstiles. Strong on entry: they record who came through a controlled door and when. Weak on everything after that. Somebody who tailgated, propped a door or left through a fire exit is wrong in the record, and the record itself usually lives on a server in the building you have just left.
- A shared digital count. People are counted on a muster-point tablet, at a lobby kiosk, or by the person running the event on the board. Everyone looking at the board sees the same tally. The devices need power and a connection.
A digital count still depends on people recording who is there. Someone injured, trapped or unconscious may be unable to reach a tablet or kiosk. That is the person the count exists to find. Every method on this list shares that limit: a count can tell you somebody is missing, and it can tell you where they were last seen. None of them can find them.
Where the count breaks, from the investigation record.
Not a survey, not a sample, and not a percentage. Two federal investigations, read in full.
There is no published rate for how often accountability fails, and the absence is worth saying out loud before anything else in this section. No measure of how often a head count is wrong, how long one takes, or how many sites fail to account for contractors was found at OSHA, the Bureau of Labor Statistics, NIOSH or the Chemical Safety Board. There is no injury category for it. Any percentage on this subject came from a vendor's own survey of its own customers, from a paywalled report, or from nowhere.
What exists instead is the investigation record, and it is far more specific than a percentage would be.
A plant explosion in Kentucky, November 2024
The Chemical Safety Board investigated a runaway reaction and explosion at a caramel colouring plant that fatally injured two employees and seriously injured three others. Its section on evacuation and emergency response reads like a list of every way a count can go wrong, in one event:
Debris and a downed power line caused by the explosion prevented employees from evacuating to their planned emergency gathering location... The groups had no documentation with them detailing who had been inside the facility at the time of the incident, and they therefore relied on memory when conducting head counts to determine whether anyone was remaining in the building. Emergency responders arrived at the facility shortly after the explosion and began transporting injured workers to the hospital before head counts could be finalized.
Then the part that should be read twice. Two people at the site had names that were pronounced the same way. A representative of one evacuated group went looking for one of them and asked the other group whether they had seen him. They had seen the other man, and said so. The board records that this miscommunication left a rail operator unidentified under the rubble of the collapsed control room. He was found deceased ten hours after the explosion, after his girlfriend told first responders he was missing.
The board is careful about what caused what, and so is this page. It concluded that, based on the extent of his injuries, he had likely died shortly after the incident. The defensible claim is not that a failed head count killed a man. It is that a head count made from memory, without a roster, at an improvised gathering point, returned a confident wrong answer, and a man lay unlocated under rubble for ten hours while the site believed he was safe. That is a smaller claim and a harder one to argue with.
A drilling rig in the Gulf of Mexico, April 2010
The United States Coast Guard's investigation into the loss of the Deepwater Horizon devotes a chapter to evacuation and search and rescue. Its finding on the count is stated as a heading:
The crew did not conduct a complete muster (headcount) to account for all personnel prior to evacuation. During the evacuation, there was confusion that resulted in an inability to achieve a full accounting of personnel before departing DEEPWATER HORIZON. The first complete muster of the 115 persons evacuated was not completed until more than an hour later, after all of the surviving crew members had boarded DAMON B. BANKSTON.
Three details from that report are worth more to a safety manager than the headline. The role existed and was assigned: the station bill named an assistant driller to take muster at each lifeboat. Counting off by voice was tried and failed, because the people being counted were too frightened to do it. And two people left the muster entirely because it was taking too long, walked to a lower deck and jumped.
That last one is the uncomfortable finding, and it cuts against the usual pitch for speeding up a count. A slow muster does not simply produce a late answer. People leave it. A tool that shortens the count is defensible on exactly that ground and on no other.
The report also records that third party contractors were excused from the drills, which is the contractor gap written down by a federal investigator in a single sentence. More on contractors and visitors.
What a system of record is actually for.
Three ideas, all older than any software, all visible in the failures above.
- The record has to be outside the hazard. The evacuated groups in Kentucky had no documentation with them. A roster that burns with the building is not a roster. US law worked this out for underground coal in 1969 and wrote it down: 30 CFR 75.1715 requires the record of who is below ground to be kept on the surface, in a place chosen to minimise the danger of destruction by fire or other hazard.
- It has to be identification, not a number.A tally of forty-one people standing in a car park answers nothing. Names and last known locations are what the incident commander can act on, and that is what OSHA's own guidance asks for.
- It has to survive the plan being wrong. The planned gathering location was unusable in Kentucky, and two ad-hoc groups formed instead. A count that only works when everybody reaches the right place is a count that works on the days you do not need it.
What Panora does, and what it does not.
The product is a system of record for the event. It is not the plan, and it is not the decision.
You run an emergency event or a drill, and the people coordinating it get a shared view of attendance and status on the muster board. People are counted on the muster-point tablet, at the lobby kiosk, or by the person running the event marking them on the board. The event keeps an after-action report, which is the part that exists a month later when somebody asks what happened.
Panora does not track people continuously. A recorded count depends on someone confirming the person is there; the board does not establish their location on its own.
What it does not do
- It does not make anyone accounted for. A board shows the people it knows about. Whoever is not on the roster and has not signed in is not an empty row, they are absent from the board entirely, which is the same defect as a sign-in sheet left on a desk.
- It does not decide anything. Whether to evacuate, whether to stand down, and whether to send anyone back inside are your team's decisions, taken by the people running the incident.
- It does not satisfy a standard on your behalf. 29 CFR 1910.38(c)(4) asks for procedures, and procedures are written, trained and run by people. Panora holds the record of what happened when they were.
- It does not find anybody. No accountability system does. It shortens the time between the alarm and a usable answer about who to look for, and hands that answer to the person who has to act on it.
Questions people actually ask about this
- What does OSHA require after an evacuation?
- Eight words: “Procedures to account for all employees after evacuation.” That is 29 CFR 1910.38(c)(4), and it is the whole federal general-industry accountability requirement. It asks for procedures rather than a result, it names no deadline, it does not mention a muster point, and it says employees.
- Does OSHA set a time limit for a head count?
- No. No number of minutes appears in 29 CFR 1910.38, in the construction equivalent at 1926.35, in the marine terminal and longshoring sections at 1917.30 and 1918.100, or in the nonmandatory appendix to Subpart E. If your site has a target time, it came from your own procedure, your insurer, a site permit or a corporate standard. Those can be real obligations. They are not OSHA's.
- Does OSHA require a designated muster point?
- No. The word does not appear in 29 CFR 1910.38 at all. The nonmandatory appendix to Subpart E discusses refuge or safe areas and advises that people be instructed to move away from the exit discharge doors and avoid congregating close to the building. That is guidance, and OSHA says so itself.
- Do contractors and visitors have to be accounted for?
- The rule says employees. OSHA's own guidance goes further: it says visitors also should be accounted for, and notes that some employers have visitors and contractors sign in on entry and use that list when accounting for everyone at the assembly area. The same guidance says coordinating a plan with other employers who share a worksite is not specifically required by OSHA standards.
- How many evacuation wardens does OSHA require?
- No number is required. The figure of one warden per twenty employees comes from the appendix to Subpart E of Part 1910, which opens by calling itself a nonmandatory guideline and phrases the figure as what generally should be adequate. What 29 CFR 1910.38(e) actually requires is that an employer designate and train employees to assist in a safe and orderly evacuation of other employees.
- How often does OSHA require an evacuation drill?
- 29 CFR 1910.38 names no interval. It requires the plan to be reviewed with each employee when the plan is developed or the employee is assigned initially to a job, when that employee's responsibilities change, and when the plan changes. OSHA's own booklet on workplace emergencies suggests holding drills as often as necessary. A fire code, a state plan or an insurer may set a frequency; the emergency action plan standard does not.
- Is every employer required to have an emergency action plan?
- Not by 29 CFR 1910.38 itself, which applies whenever another OSHA standard in that part requires a plan. In practice most employers are routed into one anyway, and OSHA says so in its own guidance: if fire extinguishers are required or provided and anyone will evacuate during an emergency, the portable fire extinguisher standard at 29 CFR 1910.157 leads to an emergency action plan.
- How often does a head count after an evacuation go wrong?
- Nobody measures it. No figure for how often a count is wrong, how long one takes, or how many sites fail to account for contractors was found at OSHA, the Bureau of Labor Statistics, NIOSH or the Chemical Safety Board. Any percentage in circulation on this subject came from a vendor's own survey or from nowhere. What does exist is the investigation record, which is more specific than a percentage would be.
- How does emergency accountability work in Panora?
- You run an emergency event or a drill. People are counted on the muster-point tablet, at the lobby kiosk, or by the person running the event marking them on the board. The people coordinating it share that count, and the event keeps an after-action report.
- Does Panora track employees' locations?
- No. Panora does not track people continuously. The tablet, kiosk and person running the event record who has been counted; the board does not establish anyone's location on its own.
- Does using Panora satisfy 29 CFR 1910.38(c)(4) for us?
- No. The standard asks for procedures, and procedures are your team's to write, train and run. Panora holds a record of what happened: who checked in, when, and what the event looked like as it ran. Whether your emergency action plan meets the standards that apply to your sites is a question for your own team and your own counsel or OSHA consultation service.
More on emergency accountability
- What OSHA requires at a muster point
No location, no distance, no sign, no deadline. What it does require instead.
- Assembly point and muster point
Who uses which word, checked against each authority's own text.
- Accounting for contractors and visitors
The rule says employees. The guidance says more. The gap is the problem.
See what the board
looks like running.
Bring your roster, your sites and the way your drills run today. We will walk through an event together and show you what it records and what it leaves to you.