18 September 2026 · 5 min read

The Incident-Ready Quality Function: A Preparedness Checklist

Short answer: An incident-ready quality function is one where the information and decisions you will need in a crisis are already in place before the crisis starts. That means named ownership, current contacts, defined roles, a classification framework, and a tested response, all sorted while things are calm. The brands that come through incidents well are almost never the ones that improvise brilliantly. They are the ones who prepared quietly, so that when the phone rang, the answer to "what do we do now" was already written down.

Use the checklist below to find your gaps before an incident does. Work through it by section. You do not need to complete it in one sitting.

Why preparedness beats reaction

When something goes wrong, the last thing you want to do is search for your insurer's out-of-hours number, or try to remember which retailer contact handles technical issues. Completing a preparedness baseline often reveals gaps a brand did not know it had: no contract with a key supplier, no out-of-hours contact for a major retailer, no confirmed spokesperson. It is far better to find those now than during an incident.

Readiness is not a single document. It is a set of things being true across your operation. Here they are, grouped the way we group them.

The checklist

Crisis and incident basics

A response team is named, with defined roles, and everyone knows who is on it
A response team lead is agreed in advance, not decided in the moment
Your top three priorities when something goes wrong are written down
Someone on the team has real crisis management experience, and you know who
Working documents exist for your key processes and business-critical information

Classification and response structure

You have a way to classify an event as an incident, an issue or a crisis
You have a severity framework so the team runs at the right pace from the first minute
A first-hour structure exists, so the order of operations is not improvised under pressure
An actions log is part of how you respond, not an afterthought

Escalation and contacts

An escalation matrix exists, with names and numbers filled in, and it is current
Out-of-hours contacts are held for every priority relationship
Retailer technical contacts are confirmed and current for each retailer
Manufacturer and key supplier contacts include out-of-hours numbers
Insurance contacts, including product and recall cover, are on file with out-of-hours details

Consumer care

Ownership of consumer care is clear: who runs it, who they report to, the process
You know your top complaint types and top products complained about
A process exists for retrieving physical evidence from consumers properly
Data and medical consent permissions are in order for recall or illness cases

Communications

Spokespeople are named, and you know who signs off external communications
Key messages exist for both consumers and corporate audiences
Ownership of social media, including complaints on social, is clear
A clear line exists between internal working conversation and external communication

Supply chain and traceability

You know which products rely on a sole manufacturer or a sole packaging supplier
Traceability can identify affected batches and where they went, within your retailers' expected window
Contracts are in place with all manufacturers and third-party suppliers
You know how long you could keep supplying customers if a facility were lost

Regulatory and legal

Relationships with the relevant authorities, including the EHO, are in place before you need them
You know whether you have in-house counsel or a retained firm, and how to reach them fast
Independent experts you might call on are identified with contact details

Insurance

You know exactly what your insurance covers, including whether recall is included
You have confirmed that key manufacturers and suppliers carry full cover, including recall

Rehearsal

You run a mock recall at least annually
Your mock tests the response, not only the traceability
You hold a review after every incident and after every mock, and each finding gets an owner and a date

How to use this

Score each item red, amber or green. Red means a real gap or active risk. Amber means in progress. Green means done and satisfactory.
Start with the reds in escalation and contacts. Stale out-of-hours numbers are the most common gap and the cheapest to fix.
Assign an owner and a date to every non-green item. A checklist with no owners is a wish list.
Revisit it quarterly. Contacts, contracts and suppliers change. A preparedness baseline is only as good as its last review.

The goal is not a perfect score. It is knowing exactly where your gaps are, so that none of them is a surprise during an incident.

Frequently asked questions

What does it mean to be recall-ready? It means the information and decisions you will need in a recall are already in place: named ownership, current contacts, a classification framework, tested traceability and a rehearsed response. Recall-ready is the difference between running the response and improvising it.

What is the most common preparedness gap? Stale contacts, especially out-of-hours numbers for retailers, suppliers and insurers. It is the gap brands find most often when they complete a baseline, and the one that hurts most in the first hour of an incident.

How often should a quality team review its incident readiness? Quarterly for the baseline, and after every incident and every mock recall. Readiness decays as your suppliers, sites, people and contacts change, so it needs periodic review to stay true.

Where should we start if we have never done this? Start with the priority items: named response team lead, a current escalation matrix, and confirmed out-of-hours contacts for your retailers, key suppliers and insurers. Those are the things most likely to be needed urgently, so they are worth getting green first.

This checklist is a short version of the preparedness baseline behind Friday4:30, the coordination layer for food and drink incidents. The full version runs to around a hundred fields across thirteen categories, completed while things are calm so that when an incident starts, the information you need is already there. If you want the full baseline, or to see how the platform holds it, get in touch.