A practitioner-led review of your self-assessment and evidence before it goes to board, testing ratings, identifying gaps and strengthening the evidence base.
posted 30th October 2026
The season of assurance
Every autumn, NHS organisations across England turn their attention to the Emergency Preparedness, Resilience and Response (EPRR) Core Standards.
Self-assessments are completed. Evidence is gathered from across the organisation. Ratings are agreed, taken to public boards for sign-off, and submitted through Integrated Care Boards to NHS England regional teams, with regional ratings due nationally before the end of December.
For 2026/27, the process is broadly consistent with previous years despite wider NHS reform. There is again no deep dive. A tri-annual review of the Core Standards themselves is under way, and a digital EPRR tool is in development.
On paper, it is a familiar cycle.
In practice, it lands at the same time as winter planning, operational pressure, organisational change and the ongoing demands of live incident response. For many EPRR leads, the Core Standards submission is completed in the margins of an already full working week.
That is precisely why it deserves a second look.
Why the Core Standards matter
The Core Standards set out the minimum EPRR requirements NHS organisations and providers of NHS-funded services are expected to meet. They underpin duties under the Civil Contingencies Act 2004, the NHS Act 2006 and the NHS Standard Contract.
But their real value is not the rating.
Their value lies in what the process asks an organisation to examine:
- whether its incident response arrangements would hold under pressure
- whether its business continuity arrangements protect the services that matter most
- whether its staff are trained, exercised and competent in their roles
- whether its on-call and command arrangements are resilient and understood
- whether it is working effectively with partners across the health and wider resilience system
- whether learning from incidents and exercises is captured and acted upon
- whether its board understands, and owns, the organisation's resilience position
Approached well, the annual submission is one of the few moments in the year when an organisation formally steps back and asks: are we ready?
The challenges
The difficulty is rarely capability.
EPRR teams across the NHS are knowledgeable, experienced and committed. The challenge is structural.
- Lean teams carrying broad remits
Many organisations rely on one or two EPRR professionals to cover planning, training, exercising, on-call support, partnership working, incident response and assurance. The Core Standards submission sits on top of that workload, not instead of it.
- Evidence lives across the organisation
Meeting the standards depends on contributions from estates, IT, procurement, communications, workforce, clinical divisions and executive leadership. Gathering current, credible evidence from colleagues who have their own pressures takes time, persistence and influence.
- Timing collides with operational pressure
The assurance cycle runs into the period when winter preparedness, surge planning and service pressures are at their most demanding. Incidents do not pause for paperwork.
- Organisational change
Restructuring across ICBs, NHS England and provider organisations can disrupt reporting lines, remove experienced colleagues and leave gaps in organisational memory.
- The pull towards paper compliance
Under pressure, it is easy for the process to become a document-gathering exercise. A plan exists, so the standard is marked as met. Whether the plan has been tested, is understood by those expected to use it, or reflects current risk is a harder question, and an important one.
- Rating drift
Without independent challenge, self-assessment ratings can drift. Sometimes optimistically. Sometimes overly cautiously. Either can leave a board with an unclear picture of where the organisation stands.
The opportunities
Treated as more than an annual return, the Core Standards process offers real value.
- An honest baseline
A robust self-assessment gives the organisation a clear, evidenced picture of its preparedness: what is working, where gaps remain and what needs prioritising over the next twelve months.
- Board engagement
The requirement for board sign-off is an opportunity to brief executive and non-executive directors properly on resilience risk, not simply to present a rating. Boards that understand their position are better placed to support investment and challenge.
- Joined-up working inside the organisation
Gathering evidence across departments builds relationships and shared understanding. Business continuity becomes a shared responsibility rather than an EPRR team task. Colleagues who contribute to the evidence are more likely to know their role when an incident happens.
- Joined-up working across the system
The process creates natural points of contact with ICBs, Local Health Resilience Partnerships, Local Resilience Forums, local authorities and neighbouring providers. Shared risks, mutual aid arrangements and common learning can be identified and strengthened.
- A focused training and exercising programme
The assessment highlights where staff competence, exercising cycles or command training need attention, giving the training and exercising programme a clear evidence base.
- Learning that leads to change
Reviewing lessons from incidents and exercises against the standards is a practical test of whether learning has translated into improvement, or remains in a debrief report.
- Readiness for what comes next
With a tri-annual review of the Core Standards in progress, organisations with a well-evidenced, current position will be better placed to adapt to any revised expectations.
Three questions worth asking
Before this year's submission is signed off, it is worth asking three questions.
1
Would our arrangements hold?
Not whether the plans exist, but whether they would work during a prolonged, complex incident, with key staff unavailable and pressure building.
2
What is the cost of not closing the gap?
Partial compliance carries an expectation of reaching full compliance within twelve months. Gaps left open carry operational, governance and reputational consequences if tested by a real incident.
3
Can we evidence it?
Assurance depends on evidence that is current, credible and proportionate. If scrutiny follows an incident, that evidence will matter.
How Applied Resilience supports
Our starting point is simple: your in-house team is capable. What is often in short supply is capacity.
Applied Resilience works alongside EPRR teams to share the load, provide independent perspective and strengthen preparedness, without taking ownership away from the organisation.
Support is flexible and built around your existing arrangements. It can include:
Support that fits your organisation
Every organisation is different. Our support models reflect that:
Why Applied Resilience
Applied Resilience is the UK's first Public Service Mutual dedicated to resilience.
Our team are practitioners, managing live incidents, not recounting them. We have operated in strategic and tactical command environments and worked across NHS organisations, local authorities, emergency services and Local Resilience Forums.
We are confidential, neutral and free of conflicts of interest. Our contracts are fixed cost. And our work is hands-on and tailored, built around your organisation rather than a generic model.
We understand the Core Standards because we understand what they are designed to test: whether an organisation is ready when it matters.
Speak to Applied Resilience
If your team is working through this year's Core Standards submission, preparing for board sign-off, or planning how to close gaps before next year's cycle, we can help.
