Responsible jurisdictions have dozens of preparedness documents, often organized into different categories or layers (plans, hazard-specific playbooks, operating procedures for certain capabilities, etc.). Keeping these documents updated and knowing which ones most need to be reviewed, exercised, and revised can be a challenge. Over the last year, Hartsfield-Jackson Atlanta International Airport (ATL), developed a system for tracking its plans and clarifying to leadership which ones need the most attention. It is a “simple” system built on data visualization software that reads the spreadsheets most emergency managers devote many hours to analyzing and maintaining. This article describes the process used to score and prioritize ATL’s plans, which can be adapted for other agencies to help visualize their own data.

Scoring Urgency

In ATL’s system, each plan is given a score from 1 to 5. The lowest total score indicates the most urgency in reviewing and updating that plan. Plans are scored in several areas:

• The amount of time since the plan has been updated;
• The completeness of the plan; and
• The level of detail in the plan.

First, plans are ranked according to their age: 5 (revised in the past two years), 3 (revised from three to five years ago), and 1 (older than five years). Next, they are given points based on their development status: 5 (complete), 3 (under review), and 1 (under development, because they require more attention). Finally, they are ranked based on their operational detail: 1 (a standard operating plan [SOP], because SOPs are critical for delivering capabilities), 3 (a mid-level plan that supports a higher-level plan) and 5 (a master plan, such as a high-level conceptual plan, because it is less immediately tied to delivering capabilities).

This approach elevates current, fully developed, operational documents at ATL while still crediting the strategic role of higher-level frameworks for decision support and exercise prioritization at the emergency operations center. Table 1 is an example of the scoring of several different plans.

Once individual plans are scored, they are added, and the sum is divided by 3 to yield a total plan capability score of somewhere between 1.0 and 5.0. Low scores indicate a high level of urgency in reviewing, completing, or exercising that plan. Think of this process as scoring the organization’s comfort with each plan. For example, a high-level plan that is complete, has recently been updated, and only applies to a few hazards will score the most “comfort” points. Those that score the lowest number of points require the greatest attention.

Relevance Matters

Not all plans address hazards equally, however. A further set of adjustments is applied to the above capability scores based on how relevant they are to preparedness in this jurisdiction. Relevance is the relationship of that plan to hazards faced by the airport. A plan that would be called upon for five hazards in a risk assessment should be scrutinized more than one that only addresses one hazard. For example, a cyber plan focused on cyber incidents would be given five points. Whereas a family reunification plan, which might come into play for four or five different hazards, would be given 1 point.

For each hazard, look at every plan that touches it (see Table 2). Each plan has a capability score (1–5), and that plan–hazard pair would receive a relevance weight (1–5). Multiply the capability score by the relevance weight to get a weighted capability for the plan–hazard relationship. This score represents the plan’s readiness (the baseline).

Adding a Layer of Performance Evaluation

Post-incident evaluation results also impact scores. As plans are exercised (or assessed during real-world incidents), the evaluation of their capability, or sufficiency, is also scored. For ATL, scoring is based on the traditional Homeland Security Exercise and Evaluation Program evaluation ratings:

• Performed without challenges (P), awarded 5 points
• Performed with some challenges (S), awarded 3 points
• Performed with major challenges (M), awarded 1 point
• Unable to be performed (U), awarded 0 points

At this stage, the spread of scores widens significantly, clarifying which plans need the most attention and which are performing well.

Formula:
Preparedness Score = [(Plan Type + Recency + Development Status) / 3 × Relevance Weight × 0.5] + (After-Action Performance × 0.5)

This calculation blends two dimensions:

• Capability: How strong, current, and relevant the plan is on paper.
• Performance: How effectively that capability translated into action during exercises or real incidents.

In Figure 1, plans are ranked from highest to lowest score—where lower scores signal higher urgency for improvement (also see Figure 2). To help decision-makers quickly assess priorities, color-coding is applied:

• Red (1.0–4.5): Immediate attention required—plans outdated or underperforming
• Yellow (4.6–7.8): Moderate priority—plans functional but needing review
• Green (7.9–10): Low priority—plans current and validated through performance

This combined scoring method ensures the dashboard reflects not only how well a plan is written, but also how well it performs when tested.

The Future of Risk Assessment

All risks are not equal. The likelihood and impact of a risk should influence the urgency of reviewing a plan. As such, an upcoming enhancement to this process is to weave in ATL’s Threat Hazard Identification and Risk Assessment (THIRA), which will allow this model to further pinpoint plans that are more critical, based on likelihood and impact of the threats those plans help mitigate. Since THIRA will rank the airport’s multiple risks based on likelihood and impact, each threat will generate a numeric score that can be factored into the composite score of the plan that addresses that risk.

For example, the risk of a major snowstorm in Atlanta would score very low, so the plan for snow removal is not going to be red, based on THIRA. On the other hand, the plan for cyber-protection will score high in likelihood and impact; therefore, its urgency rank also will rise. Of the plans that need updating, cyber-protection may surpass others based in part on THIRA.

Do Try This at Home

One of the great assets of this scoring system is its flexibility, and organizations with multiple emergency plans should try it. If an organization wants to score them based on their age, but not exactly the same way as ATL does, that is easy to accommodate. If it wants to weigh THIRA outcomes more than, say, the status, that is also an easy tweak.

Note that point assignments are somewhat arbitrary. There exists no proof that a plan that is 30 months old is significantly more concerning than one that is 23 months old. Draw the organization’s lines where necessary. The goal is to highlight the plans that need attention. Draw differentiating lines somewhere between 10% and 25% on those that need action. If everything is a priority, nothing is a priority.

Each jurisdiction needs a way to prioritize the attention it pays to preparedness efforts. Revising plans, developing exercises, and training are all expensive, labor-intensive undertakings, and resources must be placed where they will do the most good when it counts, saving people’s lives and livelihoods. This analytical, quantifiable way of identifying plans that need attention is worth emulating.